icedid | ef20adb4d51e9ed26be444d668e624f63581c6ef8ba773a6afddc6cd333a372b | Triage™

Analysis

max time kernel
68s
max time network
74s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
30/03/2022, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef20adb4d51e9ed26be444d668e624f63581c6ef8ba773a6afddc6cd333a372b.dll
Size 346KB
Sample220330-alhe2adca2
SHA256 ef20adb4d51e9ed26be444d668e624f63581c6ef8ba773a6afddc6cd333a372b
MD5 19c66119587eab8e996f06a528e5445c
SHA1 606da251f6a352df68c9848461c8c2152b5a878e
SHA512 22ccf8daf5e6df71db941a4b3faf699fabf21a7c595bad9f5f25d14eed6e4c3fe60fdd38439d3ba7dd59e7c2b5727d38440c0b7e45f2fdf167e3e6f684ac5672
MD5 SHA1 SHA512

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/1372-125-0x0000000075680000-0x0000000075686000-memory.dmp	IcedidFirstLoader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 1372	1580	regsvr32.exe	76
PID 1580 wrote to memory of 1372	1580	regsvr32.exe	76
PID 1580 wrote to memory of 1372	1580	regsvr32.exe	76

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ef20adb4d51e9ed26be444d668e624f63581c6ef8ba773a6afddc6cd333a372b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ef20adb4d51e9ed26be444d668e624f63581c6ef8ba773a6afddc6cd333a372b.dll
  2⤵
  PID:1372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1372-125-0x0000000075680000-0x0000000075686000-memory.dmp

Download