icedid | 31131d336a6af187a9c3133be42b933439cfb53f5e0296d1b530c55bd186e37f | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
14-04-2022 11:41

Sharing

Report Analysis Logs

General

Target

31131d336a6af187a9c3133be42b933439cfb53f5e0296d1b530c55bd186e37f.dll
Size

195KB
MD5

b633f07c460d74b860420f8ce61e7226
SHA1

6e0df124859121b9ffb08531688beba9780aecd5
SHA256

31131d336a6af187a9c3133be42b933439cfb53f5e0296d1b530c55bd186e37f
SHA512

b4f630911de53aaa4ebf028231e9ba145967e44a01e1102c3245f266ec8d4ea761b6a8ccacbf8a39647d6eb392d882c88edc3550b3e8981c1883d0b4cf5100ce

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

colombosuede.club

colosssueded.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3164-131-0x0000000074AA0000-0x0000000074AA6000-memory.dmp	IcedidSecondLoader
behavioral2/memory/3164-132-0x0000000074AA0000-0x0000000074AE0000-memory.dmp	IcedidSecondLoader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4312 wrote to memory of 3164	4312	regsvr32.exe	regsvr32.exe
PID 4312 wrote to memory of 3164	4312	regsvr32.exe	regsvr32.exe
PID 4312 wrote to memory of 3164	4312	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\31131d336a6af187a9c3133be42b933439cfb53f5e0296d1b530c55bd186e37f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\31131d336a6af187a9c3133be42b933439cfb53f5e0296d1b530c55bd186e37f.dll
  2⤵
  PID:3164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3164-130-0x0000000000000000-mapping.dmp

Download
memory/3164-131-0x0000000074AA0000-0x0000000074AA6000-memory.dmp

Filesize
24KB

Download
memory/3164-132-0x0000000074AA0000-0x0000000074AE0000-memory.dmp

Filesize
256KB

Download