icedid | a930c4e91e95095ece02d7458c0ebcf911c31e6d82fe53432c5ea121a6cdc930 | Triage

Analysis

max time kernel
52s
max time network
185s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
07/10/2022, 14:42

Sharing

Report Analysis Logs

General

Target

LpQwJw.dll
Size

479KB
MD5

ff0659f9c55b7bf3c2571b0ac3336db4
SHA1

a4f5d4eb04ee20ca7537bea06f8b5a40a263f46f
SHA256

a930c4e91e95095ece02d7458c0ebcf911c31e6d82fe53432c5ea121a6cdc930
SHA512

06830cc7b396cbca068a58f8533a8d5c53f80a09221941df3c6388701a3cf567bea8e6d62c3793607ccf648c639d08cc9917a144731796bfc45be040e7b743f3
SSDEEP

6144:jT9EzyOHtyKDRZFLincnzifwl1nKcpE+F6SpmfSJOea/89X7VLFdmlD20m9W:jxEzyKyyv4SnKcpzXFI20p

Score

10^/10

icedid 140125615 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

140125615

C2

fireskupigar.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 1 IoCs

flow	pid	Process
12	3952	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3952	rundll32.exe
3952	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 3952	4000	cmd.exe	71
PID 4000 wrote to memory of 3952	4000	cmd.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LpQwJw.dll,#1
1⤵
PID:2912

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\system32\rundll32.exe
  rundll32 LpQwJw.dll,#2
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3952-121-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/3952-127-0x000001AA50200000-0x000001AA50206000-memory.dmp

Filesize
24KB

Download