icedid | f8a4cf697ec22aa21167254cf454e0cfadad087b23781b10f5c5ee7c8cd52afa

Analysis

max time kernel
145s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 02:32

Target

a6275383ffec22509908a083fa77d250ef4ccde0ef488dad7818d1eceb9e2998.dll
Size

250KB
MD5

5dd964b340c61f0e9d9577c2c0052084
SHA1

49f9f86af31fb8853456a8faae0ea23b3d59bb71
SHA256

a6275383ffec22509908a083fa77d250ef4ccde0ef488dad7818d1eceb9e2998
SHA512

af2d54db1894f8e7728364abae85bbb2cc82591f21b053614f21125e2023578ed91688d0782693edbeed7f42e252207e895d0c96f96d94d22bf3d34d35c9d8a9
SSDEEP

6144:EXw8LQvGT/gMbFE8i7WFxeKFu5NKHc3As2su303oR5AO35ycC:EX5UM//a84W7Du5QHc3pu303oPtYcC

Score

10^/10

Family

icedid

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 1 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/1880-0-0x0000000074E30000-0x0000000074E85000-memory.dmp	IcedidSecondLoader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1728 wrote to memory of 1880	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1880	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1880	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1880	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1880	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1880	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1880	1728	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6275383ffec22509908a083fa77d250ef4ccde0ef488dad7818d1eceb9e2998.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6275383ffec22509908a083fa77d250ef4ccde0ef488dad7818d1eceb9e2998.dll,#1
2⤵
PID:1880

memory/1880-0-0x0000000074E30000-0x0000000074E85000-memory.dmp

Filesize
340KB

Download
memory/1880-1-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download