icedid | 46b9f98c5b291d76ba91e43e5d8a980ab1ea24e62da044fa5173f42950bda0f1 | Triage

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
17-04-2022 16:31

Sharing

Report Analysis Logs

General

Target

46b9f98c5b291d76ba91e43e5d8a980ab1ea24e62da044fa5173f42950bda0f1.dll
Size

278KB
MD5

ed0848e23ab64f82bb5196da308c6b6f
SHA1

cef4b3dacef49c0d3c9cc49a23a9c11401277e54
SHA256

46b9f98c5b291d76ba91e43e5d8a980ab1ea24e62da044fa5173f42950bda0f1
SHA512

44ed59fdd711cedb84ee4bbe5a6c9f7d095830f4a6e54f513fd675a0ec3bf30c4fc262b8aa6efae0081c9748090c91e0bc57fcfa24600e0a4460bbc7db634b7d

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

kravynolu.cyou

nikushotomo.cyou

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2348-131-0x0000000075130000-0x0000000075136000-memory.dmp	IcedidSecondLoader
behavioral2/memory/2348-132-0x0000000075130000-0x0000000075183000-memory.dmp	IcedidSecondLoader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3816 wrote to memory of 2348	3816	rundll32.exe	rundll32.exe
PID 3816 wrote to memory of 2348	3816	rundll32.exe	rundll32.exe
PID 3816 wrote to memory of 2348	3816	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46b9f98c5b291d76ba91e43e5d8a980ab1ea24e62da044fa5173f42950bda0f1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3816

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46b9f98c5b291d76ba91e43e5d8a980ab1ea24e62da044fa5173f42950bda0f1.dll,#1
2⤵
PID:2348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2348-130-0x0000000000000000-mapping.dmp

Download
memory/2348-131-0x0000000075130000-0x0000000075136000-memory.dmp

Filesize
24KB

Download
memory/2348-132-0x0000000075130000-0x0000000075183000-memory.dmp

Filesize
332KB

Download