icedid | 9814a8f9f29e6efb4a7896f61ced334cc5567c3aa61a66325eca76360f1226b4

Resubmissions

28-09-2024 07:53

28-09-2024 07:50

28-09-2024 07:38

max time kernel
596s
max time network
599s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 07:53

Target

level.dll
Size

789KB
MD5

4b393812c9241e1c77eef7c09ce1e1d9
SHA1

6139ef7bb6c9b0b48bedd755917e7944483e54c4
SHA256

9814a8f9f29e6efb4a7896f61ced334cc5567c3aa61a66325eca76360f1226b4
SHA512

a55206bf2df1ee322bbede2dd738fb67f2672398cc4289c5a5a63c76105dabf9633c9126d72a65110ff8a1cda7210371ead704d8027c7bd13ebc5078811ea508
SSDEEP

6144:GhQd+ZW/3TvUCWysU2XN92nIMkS9yjygIL1ZaquKIwsjd5vRukMi/mf+0Hlqn//P:sEv9yjpIrH6BjfEkPmt+/bYujcpZ

Score

10^/10

Family

icedid

Campaign

3828440134

aptekoagraliy.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1136	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 1136	1560	cmd.exe	108
PID 1560 wrote to memory of 1136	1560	cmd.exe	108

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\level.dll,#1
1⤵
PID:2472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4092,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:8
1⤵
PID:4020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2244

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\system32\rundll32.exe
  rundll32 level.dll scab /k haval462
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3756,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:8
1⤵
PID:1964

memory/1136-0-0x000002AB30CF0000-0x000002AB30CF4000-memory.dmp

Filesize
16KB

Download
memory/3152-1-0x00007FFFCE4D1000-0x00007FFFCE4D2000-memory.dmp

Filesize
4KB

Download
memory/3152-2-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/3152-9-0x00007FFFCE4D1000-0x00007FFFCE4D2000-memory.dmp

Filesize
4KB

Download