icedid | be443555adde2329d2e6392b6549c3856fa0ab250f3e56798e91044c1cd95751

Analysis

max time kernel
125s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 11:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a/seagem.bat
Size

1KB
MD5

54f37ed83c9c52fc14cfb808b56f558e
SHA1

576ac72dadf9e5b2b3d742bcf1ccda7002d76b87
SHA256

1195439fcd3deeff79ee8e3bc4d50e5c8015082e307182da2b252cc0ebf4f8e5
SHA512

7834ee399f4a0555606bee8ea54629c44a973f01d495572221e2b6003de8103ca83c177daf5003160162274f8dfa7232b946a16ac944e344f3d7b7bd589ffefe

Score

10^/10

icedid 2254758066 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

2254758066

opraadeadiwenna.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

2 844 rundll32.exe
4 844 rundll32.exe
5 844 rundll32.exe
Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

844 rundll32.exe
844 rundll32.exe
844 rundll32.exe
844 rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

844 rundll32.exe
844 rundll32.exe
844 rundll32.exe
844 rundll32.exe

flow	pid	process
2	844	rundll32.exe
4	844	rundll32.exe
5	844	rundll32.exe

pid	process
844	rundll32.exe
844	rundll32.exe
844	rundll32.exe
844	rundll32.exe

pid	process
844	rundll32.exe
844	rundll32.exe
844	rundll32.exe
844	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1928 wrote to memory of 1556	1928	cmd.exe	xcopy.exe
PID 1928 wrote to memory of 1556	1928	cmd.exe	xcopy.exe
PID 1928 wrote to memory of 1556	1928	cmd.exe	xcopy.exe
PID 1928 wrote to memory of 844	1928	cmd.exe	rundll32.exe
PID 1928 wrote to memory of 844	1928	cmd.exe	rundll32.exe
PID 1928 wrote to memory of 844	1928	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\a\seagem.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\system32\xcopy.exe
xcopy /s /i /e /h unedifying.dll C:\Users\Admin\AppData\Local\Temp\*
2⤵
PID:1556

C:\Windows\system32\rundll32.exe
rundll32 C:\Users\Admin\AppData\Local\Temp\unedifying.dll,init
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\unedifying.dll
Filesize
269KB

MD5
012da0b3ac0042942cd3b37915e799ba

SHA1
848ec6dadfd86129908bf5cf51e34fb1d0e3ca62

SHA256
c7d63b44ed478fe48468ddee84beb324712b22602b8c8a1ee2de75445f18528e

SHA512
bc5f4f3940035a71d810692c65dbec81c3344f6a454c4b6cf666286edbeda737fdfdb962e7009d32a37a02476424c98605b7a054b312ca9f0b47168e8bc0948c

Download Submit
\Users\Admin\AppData\Local\Temp\unedifying.dll
Filesize
269KB

MD5
012da0b3ac0042942cd3b37915e799ba

SHA1
848ec6dadfd86129908bf5cf51e34fb1d0e3ca62

SHA256
c7d63b44ed478fe48468ddee84beb324712b22602b8c8a1ee2de75445f18528e

SHA512
bc5f4f3940035a71d810692c65dbec81c3344f6a454c4b6cf666286edbeda737fdfdb962e7009d32a37a02476424c98605b7a054b312ca9f0b47168e8bc0948c

Download Submit
\Users\Admin\AppData\Local\Temp\unedifying.dll
Filesize
269KB

MD5
012da0b3ac0042942cd3b37915e799ba

SHA1
848ec6dadfd86129908bf5cf51e34fb1d0e3ca62

SHA256
c7d63b44ed478fe48468ddee84beb324712b22602b8c8a1ee2de75445f18528e

SHA512
bc5f4f3940035a71d810692c65dbec81c3344f6a454c4b6cf666286edbeda737fdfdb962e7009d32a37a02476424c98605b7a054b312ca9f0b47168e8bc0948c

Download Submit
\Users\Admin\AppData\Local\Temp\unedifying.dll
Filesize
269KB

MD5
012da0b3ac0042942cd3b37915e799ba

SHA1
848ec6dadfd86129908bf5cf51e34fb1d0e3ca62

SHA256
c7d63b44ed478fe48468ddee84beb324712b22602b8c8a1ee2de75445f18528e

SHA512
bc5f4f3940035a71d810692c65dbec81c3344f6a454c4b6cf666286edbeda737fdfdb962e7009d32a37a02476424c98605b7a054b312ca9f0b47168e8bc0948c

Download Submit
\Users\Admin\AppData\Local\Temp\unedifying.dll
Filesize
269KB

MD5
012da0b3ac0042942cd3b37915e799ba

SHA1
848ec6dadfd86129908bf5cf51e34fb1d0e3ca62

SHA256
c7d63b44ed478fe48468ddee84beb324712b22602b8c8a1ee2de75445f18528e

SHA512
bc5f4f3940035a71d810692c65dbec81c3344f6a454c4b6cf666286edbeda737fdfdb962e7009d32a37a02476424c98605b7a054b312ca9f0b47168e8bc0948c

Download Submit
memory/844-55-0x0000000000000000-mapping.dmp

Download
memory/844-61-0x00000000001F0000-0x00000000001F9000-memory.dmp

Filesize
36KB

Download
memory/1556-54-0x0000000000000000-mapping.dmp

Download