Resubmissions
28-07-2021 10:21
210728-47rr4fbrl2 1020-05-2021 22:30
210520-jb29avnrae 1006-04-2021 09:24
210406-3zhhrb3h12 10Analysis
-
max time kernel
149s -
max time network
131s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
06-04-2021 09:24
General
-
Target
ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0.dll
-
Size
63KB
-
MD5
fcb6cf720c45b554c5f689fa914ffd2c
-
SHA1
4d247be7e4c3ee51c026c49dc4b9f59479e8ca77
-
SHA256
ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0
-
SHA512
a27fb5b32662f0624be8b96aaab8e8b09933dee0c996009970d8f7348d5df2142eb23f9215c35c95640a767399dce4636122dc81e58b5cc15ff3ffa3a6a86514
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
2608516171
C2
234willkids.uno
Extracted
Family
icedid
rsa_pubkey.plain
Extracted
Family
icedid
Botnet
478101429
C2
gabry4saver.website
usser234dopper.space
tasyateles.club
jrburnit.website
Attributes
-
url_path
/news/
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
IcedID First Stage Loader 1 IoCs
-
Blocklisted process makes network request 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\arrive_x64.tmp",update /i:"SickCash\license.dat"2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
-
Filesize
352KB
-
Filesize
20KB