icedid | 0dc2f51c2f087769a91ee4349a7dc94846427577a24ba6fffeaa9fd9a25a54bb | Triage

Analysis

max time kernel
145s
max time network
157s
platform
windows7_x64
resource
win7-20220414-en
submitted
21-05-2022 00:07

Sharing

Report Analysis Logs

General

Target

0dc2f51c2f087769a91ee4349a7dc94846427577a24ba6fffeaa9fd9a25a54bb.dll
Size

224KB
MD5

9e754bbe3e8d27ade46b544ca82d68b2
SHA1

7a82992b50aefe5599c159bb069687250d7b00ab
SHA256

0dc2f51c2f087769a91ee4349a7dc94846427577a24ba6fffeaa9fd9a25a54bb
SHA512

6af4c48eb1c975b08c3a5fd7553e45aa064a39116442772fc3479a942a41b88125e434784a16c78917661c377d000251c820330d8de35cf4d8b3c27cac60e41e

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

loadberlin.casa

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1664-56-0x0000000074CC0000-0x0000000074CC6000-memory.dmp	IcedidFirstLoader
behavioral1/memory/1664-57-0x0000000074CC0000-0x0000000074D04000-memory.dmp	IcedidFirstLoader

Blocklisted process makes network request 20 IoCs

Processes:

rundll32.exe

flow	pid	process
3	1664	rundll32.exe
4	1664	rundll32.exe
6	1664	rundll32.exe
8	1664	rundll32.exe
10	1664	rundll32.exe
11	1664	rundll32.exe
13	1664	rundll32.exe
14	1664	rundll32.exe
16	1664	rundll32.exe
17	1664	rundll32.exe
21	1664	rundll32.exe
22	1664	rundll32.exe
24	1664	rundll32.exe
25	1664	rundll32.exe
27	1664	rundll32.exe
28	1664	rundll32.exe
29	1664	rundll32.exe
30	1664	rundll32.exe
32	1664	rundll32.exe
33	1664	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1948 wrote to memory of 1664	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1664	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1664	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1664	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1664	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1664	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1664	1948	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dc2f51c2f087769a91ee4349a7dc94846427577a24ba6fffeaa9fd9a25a54bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dc2f51c2f087769a91ee4349a7dc94846427577a24ba6fffeaa9fd9a25a54bb.dll,#1
2⤵
- Blocklisted process makes network request
PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1664-54-0x0000000000000000-mapping.dmp

Download
memory/1664-55-0x00000000754A1000-0x00000000754A3000-memory.dmp

Filesize
8KB

Download
memory/1664-56-0x0000000074CC0000-0x0000000074CC6000-memory.dmp

Filesize
24KB

Download
memory/1664-57-0x0000000074CC0000-0x0000000074D04000-memory.dmp

Filesize
272KB

Download