icedid | 373efeaaf3f5dbdec48866c9e5f5da724066e7b5828681e37bc47ded4e081418 | Triage

Analysis

max time kernel
156s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
02-05-2022 15:39

Sharing

Report Analysis Logs

General

Target

373efeaaf3f5dbdec48866c9e5f5da724066e7b5828681e37bc47ded4e081418.dll
Size

148KB
MD5

d386b9f849baec0bd8f5f9992419de14
SHA1

2d4d9e7f85306c68cf8e9a6b08753bd10b173744
SHA256

373efeaaf3f5dbdec48866c9e5f5da724066e7b5828681e37bc47ded4e081418
SHA512

a9e5b22d258dc047cf0d0f69170e2f2013eab29fa4cedfb29e604ade49e7724c30d75d75f5e283fde74ca3222c80e88860969c5034684bf86a8b6f968d5629ca

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

justiceminister.best

fivejudgescatholic.cyou

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5060-131-0x0000000075440000-0x0000000075446000-memory.dmp	IcedidSecondLoader
behavioral2/memory/5060-132-0x0000000075440000-0x0000000075479000-memory.dmp	IcedidSecondLoader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4164 wrote to memory of 5060	4164	rundll32.exe	rundll32.exe
PID 4164 wrote to memory of 5060	4164	rundll32.exe	rundll32.exe
PID 4164 wrote to memory of 5060	4164	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\373efeaaf3f5dbdec48866c9e5f5da724066e7b5828681e37bc47ded4e081418.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4164

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\373efeaaf3f5dbdec48866c9e5f5da724066e7b5828681e37bc47ded4e081418.dll,#1
2⤵
PID:5060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5060-130-0x0000000000000000-mapping.dmp

Download
memory/5060-131-0x0000000075440000-0x0000000075446000-memory.dmp

Filesize
24KB

Download
memory/5060-132-0x0000000075440000-0x0000000075479000-memory.dmp

Filesize
228KB

Download