icedid | a0a2c1bcf4275e486c1c385eda0ecf58718f52061d29bea7192f0a2af3005709

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 14:33

Target

e298ef044baada7fadb47e9b722197896b4dafa18313de9a40bf96755148e614.dll
Size

168KB
MD5

d5ce57c496199a940b18facab5968b72
SHA1

e759b9c9ec46e65e5c4790d45f833da0ee327b64
SHA256

e298ef044baada7fadb47e9b722197896b4dafa18313de9a40bf96755148e614
SHA512

fca0e9da6752257d7de464f580a5b59690f6f66dd0f17cc1f66ab926577d2cc0e61e80a5c163dcc652069fea2bc1f7c4fe40655cc5f442d58f3125dee77b7466
SSDEEP

3072:F+ymPQ38mtBMzgxpvvdoZpSjXfW8Pzkfg:FcQ38AxpOZEzO8bj

Score

10^/10

Family

icedid

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

loader

resource	yara_rule
behavioral2/memory/2548-0-0x00000000754D0000-0x000000007555E000-memory.dmp	IcedidSecondLoader
behavioral2/memory/2548-4-0x00000000754D0000-0x000000007555E000-memory.dmp	IcedidSecondLoader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 2548	4504	regsvr32.exe	87
PID 4504 wrote to memory of 2548	4504	regsvr32.exe	87
PID 4504 wrote to memory of 2548	4504	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e298ef044baada7fadb47e9b722197896b4dafa18313de9a40bf96755148e614.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e298ef044baada7fadb47e9b722197896b4dafa18313de9a40bf96755148e614.dll
  2⤵
  PID:2548

memory/2548-0-0x00000000754D0000-0x000000007555E000-memory.dmp

Filesize
568KB

Download
memory/2548-1-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Filesize
4KB

Download
memory/2548-4-0x00000000754D0000-0x000000007555E000-memory.dmp

Filesize
568KB

Download