Overview

overview

10

Static

static

file1.cms.dll

windows7_x64

10

file1.cms.dll

windows10_x64

10

Analysis

  • max time kernel
    88s
  • max time network
    132s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    18-11-2021 20:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file1.cms.dll

  • Size

    375KB

  • MD5

    4e28e9e6d6444d1ac41dd7ef7da32196

  • SHA1

    0b4eab4641ac9058babf8924610f8c58fcb5b6e4

  • SHA256

    d5a4fcb0e552cad22b1a907e874295b08e83d58bd83f9b4788c90aaad263cd87

  • SHA512

    4a33193f5585c8183eee374ca12d3cec8566b8dbdb6bf2a3abd80d24248010d288608368403986d84e5b1d219b8f7a76e1c50a1c82f3dafad560b945becabb36

Score
10/10
icedid4258209311bankersuricatatrojan

Malware Config

Extracted

Family

icedid

Campaign

4258209311

C2

sauceson.ink

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file1.cms.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2468-118-0x0000000000AD0000-0x0000000000B33000-memory.dmp
    Filesize

    396KB

    Download