icedid | d312c079c51f2bf011902df86e1ca4cac84eb7c74ff104fa48a505caa88ef2fe

Analysis

max time kernel
134s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2022 23:47

Target

challenge-files/challenge-files/collectionBoxConst.dll
Size

538KB
MD5

65641f6498b6f94b0bdeb886e448d460
SHA1

b17591ec88cccf664f911f6e8a235e082e6bd892
SHA256

51658887e46c88ed6d5861861a55c989d256a7962fb848fe833096ed6b049441
SHA512

3896899d6c80de9dd383d15dde246a4478e94b72b7c780da9a3b4e2068aac85929b8665fbe8055ca9d1586c93fc1a7cc4dbdacf47cb3b3079d1830853ba9041c
SSDEEP

6144:8DLTDShETtXZAngMPZQn41hGEn1qaM8nOD4E8ONTxyohggJXZrO:8PTDS6TvfImgBe8nO4oZG

Score

10^/10

Family

icedid

Campaign

548569227

supplementik.top

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

78 1112 rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

4648 regsvr32.exe
4648 regsvr32.exe
1112 rundll32.exe
1112 rundll32.exe

flow	pid	process
78	1112	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1388 wrote to memory of 1112	1388	cmd.exe	rundll32.exe
PID 1388 wrote to memory of 1112	1388	cmd.exe	rundll32.exe
PID 1388 wrote to memory of 4516	1388	cmd.exe	rundll32.exe
PID 1388 wrote to memory of 4516	1388	cmd.exe	rundll32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\challenge-files\challenge-files\collectionBoxConst.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4532

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\challenge-files\challenge-files\collectionBoxConst.dll"
2⤵
PID:4516

memory/1112-133-0x0000000000000000-mapping.dmp

Download
memory/1112-134-0x000001EC91340000-0x000001EC91347000-memory.dmp

Filesize
28KB

Download
memory/1112-135-0x000001EC91340000-0x000001EC91347000-memory.dmp

Filesize
28KB

Download
memory/4516-136-0x0000000000000000-mapping.dmp

Download
memory/4648-132-0x0000000002BF0000-0x0000000002BF7000-memory.dmp

Filesize
28KB

Download