icedid | 6196a0966d3fbe5726736f0fd7661a0a928fdce345cb377e79cea039594a79f0

Resubmissions

06/01/2024, 23:25

240106-3ep6hsabhj10

24/07/2020, 17:12

200724-he6fb8dnc68

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
111.dll
Size 363KB
Sample240106-3ep6hsabhj
SHA256 6196a0966d3fbe5726736f0fd7661a0a928fdce345cb377e79cea039594a79f0
MD5 4896a4b3071b13c65fefc4842464843b
SHA1 583b57b0c60a640c908fbf37f1b50fcfab57a96d
SHA512 a24eba4bfaf1c41387ba66b21ba9ddd16d2cf9b3b333fb7c11391ec517d38a4c553bf936232c8d263c4af47caba4b3d439e1864859dad55bcebce9f43b78fc19
SSDEEP 6144:MdMOmNDo0xxiR2BcDeP0PDcTeZJIUJgLdAA:MoDo0DiR2BcqP8DGerzA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

loadkanoe.casa

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4536-0-0x0000000075830000-0x00000000758A1000-memory.dmp	IcedidFirstLoader

Blocklisted process makes network request 10 IoCs

flow	pid	Process
61	4536	rundll32.exe
64	4536	rundll32.exe
67	4536	rundll32.exe
70	4536	rundll32.exe
75	4536	rundll32.exe
98	4536	rundll32.exe
139	4536	rundll32.exe
148	4536	rundll32.exe
195	4536	rundll32.exe
207	4536	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 4536	2572	rundll32.exe	88
PID 2572 wrote to memory of 4536	2572	rundll32.exe	88
PID 2572 wrote to memory of 4536	2572	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\111.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\111.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:4536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4536-0-0x0000000075830000-0x00000000758A1000-memory.dmp

Download

memory/4536-1-0x0000000000CC0000-0x0000000000CC1000-memory.dmp