icedid | ed8c7d85f22fbb139b20f21cde9431e063db2cfa2b29dd3ac6a2ab7586c988fe | Triage

Analysis

max time kernel
144s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
30-03-2022 00:17

Sharing

Report Analysis Logs

General

Target

ed8c7d85f22fbb139b20f21cde9431e063db2cfa2b29dd3ac6a2ab7586c988fe.dll
Size

346KB
MD5

71a11d2f8242a2ef3ba2420f163eba0d
SHA1

d040c1633eba01dbd75b2f6dad3da677480984e8
SHA256

ed8c7d85f22fbb139b20f21cde9431e063db2cfa2b29dd3ac6a2ab7586c988fe
SHA512

6c8f5a1564f9579ccf7732a107847c01e16631e60ba108a846296039fadb6670ce530e3ac28d77a9706146734587f0c09a9949fd2140f535af50de1b10528975

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1904-135-0x0000000074E20000-0x0000000074E26000-memory.dmp	IcedidFirstLoader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1128 wrote to memory of 1904	1128	regsvr32.exe	regsvr32.exe
PID 1128 wrote to memory of 1904	1128	regsvr32.exe	regsvr32.exe
PID 1128 wrote to memory of 1904	1128	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ed8c7d85f22fbb139b20f21cde9431e063db2cfa2b29dd3ac6a2ab7586c988fe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\ed8c7d85f22fbb139b20f21cde9431e063db2cfa2b29dd3ac6a2ab7586c988fe.dll
2⤵
PID:1904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1904-134-0x0000000000000000-mapping.dmp

Download
memory/1904-135-0x0000000074E20000-0x0000000074E26000-memory.dmp

Filesize
24KB

Download