icedid | be443555adde2329d2e6392b6549c3856fa0ab250f3e56798e91044c1cd95751

Analysis

max time kernel
125s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 11:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a/seagem.bat
Size 1KB
Sample221206-ng89vach59
SHA256 1195439fcd3deeff79ee8e3bc4d50e5c8015082e307182da2b252cc0ebf4f8e5
MD5 54f37ed83c9c52fc14cfb808b56f558e
SHA1 576ac72dadf9e5b2b3d742bcf1ccda7002d76b87
SHA512 7834ee399f4a0555606bee8ea54629c44a973f01d495572221e2b6003de8103ca83c177daf5003160162274f8dfa7232b946a16ac944e344f3d7b7bd589ffefe
MD5 SHA1 SHA512

Score

10^/10

icedid 2254758066 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

2254758066

opraadeadiwenna.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	844	rundll32.exe
4	844	rundll32.exe
5	844	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
844	rundll32.exe
844	rundll32.exe
844	rundll32.exe
844	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
844	rundll32.exe
844	rundll32.exe
844	rundll32.exe
844	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1556	1928	cmd.exe	28
PID 1928 wrote to memory of 1556	1928	cmd.exe	28
PID 1928 wrote to memory of 1556	1928	cmd.exe	28
PID 1928 wrote to memory of 844	1928	cmd.exe	29
PID 1928 wrote to memory of 844	1928	cmd.exe	29
PID 1928 wrote to memory of 844	1928	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\a\seagem.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\system32\xcopy.exe
  xcopy /s /i /e /h unedifying.dll C:\Users\Admin\AppData\Local\Temp\*
  2⤵
  PID:1556
- C:\Windows\system32\rundll32.exe
  rundll32 C:\Users\Admin\AppData\Local\Temp\unedifying.dll,init
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

unedifying.dll

Path C:\Users\Admin\AppData\Local\Temp\unedifying.dll
Size 269KB
SHA256 c7d63b44ed478fe48468ddee84beb324712b22602b8c8a1ee2de75445f18528e
MD5 012da0b3ac0042942cd3b37915e799ba
SHA1 848ec6dadfd86129908bf5cf51e34fb1d0e3ca62
SHA512 bc5f4f3940035a71d810692c65dbec81c3344f6a454c4b6cf666286edbeda737fdfdb962e7009d32a37a02476424c98605b7a054b312ca9f0b47168e8bc0948c
SSDEEP 6144:mTHJ5BU2WigC+/NZy40onBV14xjN8IcOzECLZ:8DB0igC+/NHBV1SjaCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

unedifying.dll

Path \Users\Admin\AppData\Local\Temp\unedifying.dll
Size 269KB
SHA256 c7d63b44ed478fe48468ddee84beb324712b22602b8c8a1ee2de75445f18528e
MD5 012da0b3ac0042942cd3b37915e799ba
SHA1 848ec6dadfd86129908bf5cf51e34fb1d0e3ca62
SHA512 bc5f4f3940035a71d810692c65dbec81c3344f6a454c4b6cf666286edbeda737fdfdb962e7009d32a37a02476424c98605b7a054b312ca9f0b47168e8bc0948c
SSDEEP 6144:mTHJ5BU2WigC+/NZy40onBV14xjN8IcOzECLZ:8DB0igC+/NHBV1SjaCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

unedifying.dll

Path \Users\Admin\AppData\Local\Temp\unedifying.dll
Size 269KB
SHA256 c7d63b44ed478fe48468ddee84beb324712b22602b8c8a1ee2de75445f18528e
MD5 012da0b3ac0042942cd3b37915e799ba
SHA1 848ec6dadfd86129908bf5cf51e34fb1d0e3ca62
SHA512 bc5f4f3940035a71d810692c65dbec81c3344f6a454c4b6cf666286edbeda737fdfdb962e7009d32a37a02476424c98605b7a054b312ca9f0b47168e8bc0948c
SSDEEP 6144:mTHJ5BU2WigC+/NZy40onBV14xjN8IcOzECLZ:8DB0igC+/NHBV1SjaCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

unedifying.dll

Path \Users\Admin\AppData\Local\Temp\unedifying.dll
Size 269KB
SHA256 c7d63b44ed478fe48468ddee84beb324712b22602b8c8a1ee2de75445f18528e
MD5 012da0b3ac0042942cd3b37915e799ba
SHA1 848ec6dadfd86129908bf5cf51e34fb1d0e3ca62
SHA512 bc5f4f3940035a71d810692c65dbec81c3344f6a454c4b6cf666286edbeda737fdfdb962e7009d32a37a02476424c98605b7a054b312ca9f0b47168e8bc0948c
SSDEEP 6144:mTHJ5BU2WigC+/NZy40onBV14xjN8IcOzECLZ:8DB0igC+/NHBV1SjaCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

unedifying.dll

Path \Users\Admin\AppData\Local\Temp\unedifying.dll
Size 269KB
SHA256 c7d63b44ed478fe48468ddee84beb324712b22602b8c8a1ee2de75445f18528e
MD5 012da0b3ac0042942cd3b37915e799ba
SHA1 848ec6dadfd86129908bf5cf51e34fb1d0e3ca62
SHA512 bc5f4f3940035a71d810692c65dbec81c3344f6a454c4b6cf666286edbeda737fdfdb962e7009d32a37a02476424c98605b7a054b312ca9f0b47168e8bc0948c
SSDEEP 6144:mTHJ5BU2WigC+/NZy40onBV14xjN8IcOzECLZ:8DB0igC+/NHBV1SjaCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/844-61-0x00000000001F0000-0x00000000001F9000-memory.dmp

Download