icedid | aebff99cbadfa1d5ddcd0167d2fc836e387dfaab2e4db85828ca2278b92c99fd

Analysis

max time kernel
172s
max time network
190s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 16:34

Target

aebff99cbadfa1d5ddcd0167d2fc836e387dfaab2e4db85828ca2278b92c99fd.dll
Size

93KB
MD5

2d0c542bb0003b496617af097c843226
SHA1

2143c533d9845d2aac619fa322d4566b5db6e7fe
SHA256

aebff99cbadfa1d5ddcd0167d2fc836e387dfaab2e4db85828ca2278b92c99fd
SHA512

9fdaedd46755b232e1dc2d28de53a91ae4169f7679e17cbd1fcdc8b15a3c21bd0527047f7ad4f271b4c2e8b0914c183bf51f4819ee938b5d624f04bbc98f50e8
SSDEEP

1536:HFLEwtQY623O9IMSa+1oe+FlfkhWaRV5QQVw9W6:GsvMSa+We+XfkhWanlVmW6

Score

10^/10

Family

icedid

explodevices.top

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 3 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/1736-57-0x0000000000160000-0x0000000000168000-memory.dmp	IcedidFirstLoader
behavioral1/memory/1736-61-0x0000000000220000-0x0000000000226000-memory.dmp	IcedidFirstLoader
behavioral1/memory/1736-64-0x0000000000150000-0x0000000000155000-memory.dmp	IcedidFirstLoader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1636 wrote to memory of 1736	1636	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 1736	1636	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 1736	1636	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 1736	1636	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 1736	1636	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 1736	1636	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 1736	1636	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\aebff99cbadfa1d5ddcd0167d2fc836e387dfaab2e4db85828ca2278b92c99fd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\aebff99cbadfa1d5ddcd0167d2fc836e387dfaab2e4db85828ca2278b92c99fd.dll
2⤵
PID:1736

memory/1636-54-0x000007FEFB851000-0x000007FEFB853000-memory.dmp

Filesize
8KB

Download
memory/1736-55-0x0000000000000000-mapping.dmp

Download
memory/1736-56-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download
memory/1736-57-0x0000000000160000-0x0000000000168000-memory.dmp

Filesize
32KB

Download
memory/1736-61-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download
memory/1736-64-0x0000000000150000-0x0000000000155000-memory.dmp

Filesize
20KB

Download