icedid | 68dce9f214e7691db77a2f03af16a669a3cb655699f31a6c1f5aaede041468ff | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-01-2023 09:24

Sharing

Report Analysis Logs

General

Target

problem.dll
Size

632KB
MD5

9760913fb7948f2983831d71a533a650
SHA1

af5eaf010e47eb1c4b073f31aa725df0e5547a25
SHA256

68dce9f214e7691db77a2f03af16a669a3cb655699f31a6c1f5aaede041468ff
SHA512

0c2b846b0836fa8a3669f736fa3db69fb04491dba67cb798556b290a97915b6d149b58a0b6cc96be9bbed3d0686da048f7f071ad3cf6fec3ea70c70ad0ba964a
SSDEEP

6144:jk0TC2AM0BdNIrVhPkP0qIo8pWmtlIDg8ZdOp/qc5rF:jkeL0BdmPXq983t58nOp35rF

Score

10^/10

icedid 2634746917 banker loader trojan

Malware Config

Extracted

Family

icedid

Botnet

2634746917

C2

june85.cyou

golddisco.top

Attributes

auth_var
2
url_path
/audio/

Extracted

Family

icedid

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1056-56-0x0000000074340000-0x0000000074346000-memory.dmp	IcedidSecondLoader
behavioral1/memory/1056-57-0x0000000074340000-0x00000000748EE000-memory.dmp	IcedidSecondLoader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1808 wrote to memory of 1056	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1056	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1056	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1056	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1056	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1056	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1056	1808	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\problem.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\problem.dll,#1
2⤵
PID:1056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1056-54-0x0000000000000000-mapping.dmp

Download
memory/1056-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1056-56-0x0000000074340000-0x0000000074346000-memory.dmp

Filesize
24KB

Download
memory/1056-57-0x0000000074340000-0x00000000748EE000-memory.dmp

Filesize
5.7MB

Download