icedid | a2eac98f26c51e5dcdf78e707098297de8564d73200341512ad71cf9a3f7bbab

Analysis

max time kernel
169s
max time network
177s
platform
windows7_x64
resource
win7-20220414-en
submitted
03/05/2022, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2eac98f26c51e5dcdf78e707098297de8564d73200341512ad71cf9a3f7bbab.dll
Size 278KB
Sample220503-angxaadcc7
SHA256 a2eac98f26c51e5dcdf78e707098297de8564d73200341512ad71cf9a3f7bbab
MD5 81726d9479ed369c2477144116123ae7
SHA1 014225d2e82587f4d34fe7e9adec6f0b9d9adb49
SHA512 9b1b795dc53e9895f8c47a50c4aaf6e9f68c3636546735e634e6b6b758625d2d930bf571bd087a79ba4db48f9a111daf7dbabfa03aa8d7b69589da01edfd1aec
MD5 SHA1 SHA512

Score

10^/10

icedid 2398486359 banker loader trojan

Malware Config

Extracted

Family

icedid

Botnet

2398486359

kravynolu.cyou
nikushotomo.cyou

Attributes

auth_var
1
url_path
/audio/

Extracted

Family

icedid

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

loader

resource	yara_rule
behavioral1/memory/884-56-0x00000000746F0000-0x00000000746F6000-memory.dmp	IcedidSecondLoader
behavioral1/memory/884-57-0x00000000746F0000-0x0000000074743000-memory.dmp	IcedidSecondLoader

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 884	1936	rundll32.exe	27
PID 1936 wrote to memory of 884	1936	rundll32.exe	27
PID 1936 wrote to memory of 884	1936	rundll32.exe	27
PID 1936 wrote to memory of 884	1936	rundll32.exe	27
PID 1936 wrote to memory of 884	1936	rundll32.exe	27
PID 1936 wrote to memory of 884	1936	rundll32.exe	27
PID 1936 wrote to memory of 884	1936	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2eac98f26c51e5dcdf78e707098297de8564d73200341512ad71cf9a3f7bbab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2eac98f26c51e5dcdf78e707098297de8564d73200341512ad71cf9a3f7bbab.dll,#1
  2⤵
  PID:884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-55-0x0000000075D21000-0x0000000075D23000-memory.dmp

Download

memory/884-56-0x00000000746F0000-0x00000000746F6000-memory.dmp

Download

memory/884-57-0x00000000746F0000-0x0000000074743000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads