icedid | 68dce9f214e7691db77a2f03af16a669a3cb655699f31a6c1f5aaede041468ff | Triage

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
17-04-2022 07:05

Sharing

Report Analysis Logs

General

Target

68dce9f214e7691db77a2f03af16a669a3cb655699f31a6c1f5aaede041468ff.dll
Size

632KB
MD5

9760913fb7948f2983831d71a533a650
SHA1

af5eaf010e47eb1c4b073f31aa725df0e5547a25
SHA256

68dce9f214e7691db77a2f03af16a669a3cb655699f31a6c1f5aaede041468ff
SHA512

0c2b846b0836fa8a3669f736fa3db69fb04491dba67cb798556b290a97915b6d149b58a0b6cc96be9bbed3d0686da048f7f071ad3cf6fec3ea70c70ad0ba964a

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

june85.cyou

golddisco.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3380-131-0x0000000074910000-0x0000000074916000-memory.dmp	IcedidSecondLoader
behavioral2/memory/3380-132-0x0000000074910000-0x0000000074EBE000-memory.dmp	IcedidSecondLoader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1580 wrote to memory of 3380	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 3380	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 3380	1580	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68dce9f214e7691db77a2f03af16a669a3cb655699f31a6c1f5aaede041468ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68dce9f214e7691db77a2f03af16a669a3cb655699f31a6c1f5aaede041468ff.dll,#1
2⤵
PID:3380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3380-130-0x0000000000000000-mapping.dmp

Download
memory/3380-131-0x0000000074910000-0x0000000074916000-memory.dmp

Filesize
24KB

Download
memory/3380-132-0x0000000074910000-0x0000000074EBE000-memory.dmp

Filesize
5.7MB

Download