icedid | 7c22c1ed7690d90b8b28fd0f831ce6c7fc2c35bf6b3d9f4e0e7afb17140fb23e | Triage

Analysis

max time kernel
4294226s
max time network
175s
platform
windows7_x64
resource
win7-20220311-en
submitted
20-03-2022 03:41

Sharing

Report Analysis Logs

General

Target

7c22c1ed7690d90b8b28fd0f831ce6c7fc2c35bf6b3d9f4e0e7afb17140fb23e.dll
Size

176KB
MD5

b528c7459cb2565c3511bf390785e4c8
SHA1

018538ce2a4dad53e6cfc4ec6dbc9cad2d00845e
SHA256

7c22c1ed7690d90b8b28fd0f831ce6c7fc2c35bf6b3d9f4e0e7afb17140fb23e
SHA512

f76adeade95eeb82406b576c5e10f62c774fb5c994ebf698ec62a776811e154f7324141c54ce99bf91814481e78fdf92460563088fc1fe0e5803a4ed88b9b353

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

rotmistr.club

5kilozhuto.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/560-55-0x0000000000400000-0x0000000000406000-memory.dmp	IcedidSecondLoader
behavioral1/memory/560-56-0x0000000000400000-0x000000000043B000-memory.dmp	IcedidSecondLoader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 764 wrote to memory of 560	764	rundll32.exe	rundll32.exe
PID 764 wrote to memory of 560	764	rundll32.exe	rundll32.exe
PID 764 wrote to memory of 560	764	rundll32.exe	rundll32.exe
PID 764 wrote to memory of 560	764	rundll32.exe	rundll32.exe
PID 764 wrote to memory of 560	764	rundll32.exe	rundll32.exe
PID 764 wrote to memory of 560	764	rundll32.exe	rundll32.exe
PID 764 wrote to memory of 560	764	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c22c1ed7690d90b8b28fd0f831ce6c7fc2c35bf6b3d9f4e0e7afb17140fb23e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c22c1ed7690d90b8b28fd0f831ce6c7fc2c35bf6b3d9f4e0e7afb17140fb23e.dll,#1
2⤵
PID:560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/560-55-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/560-56-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/560-57-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download