icedid | 0dc2f51c2f087769a91ee4349a7dc94846427577a24ba6fffeaa9fd9a25a54bb | Triage

Analysis

max time kernel
158s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21-05-2022 00:07

Sharing

Report Analysis Logs

General

Target

0dc2f51c2f087769a91ee4349a7dc94846427577a24ba6fffeaa9fd9a25a54bb.dll
Size

224KB
MD5

9e754bbe3e8d27ade46b544ca82d68b2
SHA1

7a82992b50aefe5599c159bb069687250d7b00ab
SHA256

0dc2f51c2f087769a91ee4349a7dc94846427577a24ba6fffeaa9fd9a25a54bb
SHA512

6af4c48eb1c975b08c3a5fd7553e45aa064a39116442772fc3479a942a41b88125e434784a16c78917661c377d000251c820330d8de35cf4d8b3c27cac60e41e

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

loadberlin.casa

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2608-131-0x0000000074D10000-0x0000000074D16000-memory.dmp	IcedidFirstLoader
behavioral2/memory/2608-132-0x0000000074D10000-0x0000000074D54000-memory.dmp	IcedidFirstLoader

Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

28 2608 rundll32.exe
30 2608 rundll32.exe
42 2608 rundll32.exe
44 2608 rundll32.exe
46 2608 rundll32.exe
48 2608 rundll32.exe
50 2608 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2320 wrote to memory of 2608	2320	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 2608	2320	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 2608	2320	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dc2f51c2f087769a91ee4349a7dc94846427577a24ba6fffeaa9fd9a25a54bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dc2f51c2f087769a91ee4349a7dc94846427577a24ba6fffeaa9fd9a25a54bb.dll,#1
2⤵
- Blocklisted process makes network request
PID:2608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2608-130-0x0000000000000000-mapping.dmp

Download
memory/2608-131-0x0000000074D10000-0x0000000074D16000-memory.dmp

Filesize
24KB

Download
memory/2608-132-0x0000000074D10000-0x0000000074D54000-memory.dmp

Filesize
272KB

Download