icedid | f77657e1341bee58750948e1d7ea50b052ee624937144d497787967f5f422e7f

Analysis

max time kernel
112s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 13:14

Target

bzm12%3fDUHC=IlEAxkQxRpfRD&Lk_M=jJDaUNLTmiPHVoFXT&BuN_G=UytaScjGNxHYmqc_&QQvUO=GhOwZkkBdMBH&eBP=zrYR.dll
Size

210KB
MD5

17b50c1da7d23d686fccfa8de3d27a3a
SHA1

802c099a8a8f21f6e5cecc5c946f2cd52672c15e
SHA256

f77657e1341bee58750948e1d7ea50b052ee624937144d497787967f5f422e7f
SHA512

86eaa91e2b1fd1d29405a5beb65c5d1311a5efb1d5388322d323925145d9c58bad471e205a5105aacc9e46d4569345525b36178583a96c6be45253d4f08136e0
SSDEEP

6144:MJAOZ+QqO7x7MPf/tYDVBqV8WRzn6enYE:MJz+QqOF7geybnYE

Score

10^/10

Family

icedid

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

loader

Processes:

resource	yara_rule
behavioral2/memory/744-0-0x00000000750F0000-0x0000000075132000-memory.dmp	IcedidFirstLoader

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4100 744 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4100	744	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3204 wrote to memory of 744	3204	rundll32.exe	rundll32.exe
PID 3204 wrote to memory of 744	3204	rundll32.exe	rundll32.exe
PID 3204 wrote to memory of 744	3204	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bzm12%3fDUHC=IlEAxkQxRpfRD&Lk_M=jJDaUNLTmiPHVoFXT&BuN_G=UytaScjGNxHYmqc_&QQvUO=GhOwZkkBdMBH&eBP=zrYR.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3204

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bzm12%3fDUHC=IlEAxkQxRpfRD&Lk_M=jJDaUNLTmiPHVoFXT&BuN_G=UytaScjGNxHYmqc_&QQvUO=GhOwZkkBdMBH&eBP=zrYR.dll,#1
2⤵
PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 632
3⤵
- Program crash
PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 744 -ip 744
1⤵
PID:3324

memory/744-0-0x00000000750F0000-0x0000000075132000-memory.dmp

Filesize
264KB

Download
memory/744-1-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download