icedid | 800e53e7acb97419f42d8c82e9c34a2810ebbbe98058f580719ab83e70be435c

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-01-2023 09:24

Target

problem_2.dll
Size

178KB
MD5

0defacf9edf30d2f5abe16fef26d92ac
SHA1

1d0e229fe28c42cf25f4f688bad9925864a08193
SHA256

800e53e7acb97419f42d8c82e9c34a2810ebbbe98058f580719ab83e70be435c
SHA512

5f98b4fa840da710af2581fc91999596cfe10d0fc3eb25922cd5d13669abeb070169e95fe9690010d085da34f09fe0c873266b948eab3d1dada3a47571b61e6a
SSDEEP

3072:dRNOtBIEa2A/k3xTCD4xugYOpddiT+t1xLyRlu94OApLnjWEV2rdSu:rNQIEaH/W80xugYOpHiT+t10Rlu943kd

Score

10^/10

Family

icedid

qapoloki.cyou

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 2 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/2032-56-0x0000000074900000-0x0000000074906000-memory.dmp	IcedidFirstLoader
behavioral1/memory/2032-57-0x0000000074900000-0x0000000074938000-memory.dmp	IcedidFirstLoader

Blocklisted process makes network request 28 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1776 wrote to memory of 2032	1776	rundll32.exe	rundll32.exe
PID 1776 wrote to memory of 2032	1776	rundll32.exe	rundll32.exe
PID 1776 wrote to memory of 2032	1776	rundll32.exe	rundll32.exe
PID 1776 wrote to memory of 2032	1776	rundll32.exe	rundll32.exe
PID 1776 wrote to memory of 2032	1776	rundll32.exe	rundll32.exe
PID 1776 wrote to memory of 2032	1776	rundll32.exe	rundll32.exe
PID 1776 wrote to memory of 2032	1776	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\problem_2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\problem_2.dll,#1
2⤵
- Blocklisted process makes network request
PID:2032

memory/2032-54-0x0000000000000000-mapping.dmp

Download
memory/2032-55-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download
memory/2032-56-0x0000000074900000-0x0000000074906000-memory.dmp

Filesize
24KB

Download
memory/2032-57-0x0000000074900000-0x0000000074938000-memory.dmp

Filesize
224KB

Download