icedid | ef20adb4d51e9ed26be444d668e624f63581c6ef8ba773a6afddc6cd333a372b

Analysis

Target
ef20adb4d51e9ed26be444d668e624f63581c6ef8ba773a6afddc6cd333a372b.dll
Size 346KB
Sample220330-alhe2adca2
SHA256 ef20adb4d51e9ed26be444d668e624f63581c6ef8ba773a6afddc6cd333a372b
MD5 19c66119587eab8e996f06a528e5445c
SHA1 606da251f6a352df68c9848461c8c2152b5a878e
SHA512 22ccf8daf5e6df71db941a4b3faf699fabf21a7c595bad9f5f25d14eed6e4c3fe60fdd38439d3ba7dd59e7c2b5727d38440c0b7e45f2fdf167e3e6f684ac5672
MD5 SHA1 SHA512

Score

10^/10

Family

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/1880-57-0x0000000074980000-0x0000000074986000-memory.dmp	IcedidFirstLoader

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1880	1888	regsvr32.exe	27
PID 1888 wrote to memory of 1880	1888	regsvr32.exe	27
PID 1888 wrote to memory of 1880	1888	regsvr32.exe	27
PID 1888 wrote to memory of 1880	1888	regsvr32.exe	27
PID 1888 wrote to memory of 1880	1888	regsvr32.exe	27
PID 1888 wrote to memory of 1880	1888	regsvr32.exe	27
PID 1888 wrote to memory of 1880	1888	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ef20adb4d51e9ed26be444d668e624f63581c6ef8ba773a6afddc6cd333a372b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ef20adb4d51e9ed26be444d668e624f63581c6ef8ba773a6afddc6cd333a372b.dll
  2⤵
  PID:1880

memory/1880-56-0x00000000763D1000-0x00000000763D3000-memory.dmp

Download

memory/1880-57-0x0000000074980000-0x0000000074986000-memory.dmp

Download

memory/1888-54-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp

Download