icedid | a0a2c1bcf4275e486c1c385eda0ecf58718f52061d29bea7192f0a2af3005709

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 14:33

Target
e298ef044baada7fadb47e9b722197896b4dafa18313de9a40bf96755148e614.dll
Size 168KB
Sample240229-rw458acd77
SHA256 e298ef044baada7fadb47e9b722197896b4dafa18313de9a40bf96755148e614
MD5 d5ce57c496199a940b18facab5968b72
SHA1 e759b9c9ec46e65e5c4790d45f833da0ee327b64
SHA512 fca0e9da6752257d7de464f580a5b59690f6f66dd0f17cc1f66ab926577d2cc0e61e80a5c163dcc652069fea2bc1f7c4fe40655cc5f442d58f3125dee77b7466
SSDEEP 3072:F+ymPQ38mtBMzgxpvvdoZpSjXfW8Pzkfg:FcQ38AxpOZEzO8bj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

loader

resource	yara_rule
behavioral2/memory/2548-0-0x00000000754D0000-0x000000007555E000-memory.dmp	IcedidSecondLoader
behavioral2/memory/2548-4-0x00000000754D0000-0x000000007555E000-memory.dmp	IcedidSecondLoader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 2548	4504	regsvr32.exe	87
PID 4504 wrote to memory of 2548	4504	regsvr32.exe	87
PID 4504 wrote to memory of 2548	4504	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e298ef044baada7fadb47e9b722197896b4dafa18313de9a40bf96755148e614.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e298ef044baada7fadb47e9b722197896b4dafa18313de9a40bf96755148e614.dll
  2⤵
  PID:2548

memory/2548-0-0x00000000754D0000-0x000000007555E000-memory.dmp

Download

memory/2548-1-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Download

memory/2548-4-0x00000000754D0000-0x000000007555E000-memory.dmp

Download