icedid | 4b94084b3535bd49e7099b0a445b961c3b6e6b1ca29e6de50c644442c2243bbb | Triage

Analysis

max time kernel
4294182s
max time network
138s
platform
windows7_x64
resource
win7-20220310-en
submitted
25-03-2022 00:51

Sharing

Report Analysis Logs

General

Target

4b94084b3535bd49e7099b0a445b961c3b6e6b1ca29e6de50c644442c2243bbb.dll
Size

346KB
MD5

8fcee6d5cf2526518d3349ae8359d51b
SHA1

c19643c6191cffb1925b7bb4141870aa96d624fa
SHA256

4b94084b3535bd49e7099b0a445b961c3b6e6b1ca29e6de50c644442c2243bbb
SHA512

070682ed8423751af94773945d501aa2964fc07649d02429047a062de8c54680046761fea232dab52701dc82b81bbe0330120da4cb10894d10139a8a135dcda3

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1620-57-0x0000000074120000-0x0000000074184000-memory.dmp	IcedidFirstLoader
behavioral1/memory/1620-58-0x0000000074120000-0x0000000074126000-memory.dmp	IcedidFirstLoader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1568 wrote to memory of 1620	1568	regsvr32.exe	regsvr32.exe
PID 1568 wrote to memory of 1620	1568	regsvr32.exe	regsvr32.exe
PID 1568 wrote to memory of 1620	1568	regsvr32.exe	regsvr32.exe
PID 1568 wrote to memory of 1620	1568	regsvr32.exe	regsvr32.exe
PID 1568 wrote to memory of 1620	1568	regsvr32.exe	regsvr32.exe
PID 1568 wrote to memory of 1620	1568	regsvr32.exe	regsvr32.exe
PID 1568 wrote to memory of 1620	1568	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4b94084b3535bd49e7099b0a445b961c3b6e6b1ca29e6de50c644442c2243bbb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\4b94084b3535bd49e7099b0a445b961c3b6e6b1ca29e6de50c644442c2243bbb.dll
2⤵
PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1568-54-0x000007FEFB581000-0x000007FEFB583000-memory.dmp

Filesize
8KB

Download
memory/1620-55-0x0000000000000000-mapping.dmp

Download
memory/1620-56-0x0000000075421000-0x0000000075423000-memory.dmp

Filesize
8KB

Download
memory/1620-57-0x0000000074120000-0x0000000074184000-memory.dmp

Filesize
400KB

Download
memory/1620-58-0x0000000074120000-0x0000000074126000-memory.dmp

Filesize
24KB

Download