Overview

overview

10

Static

static

core.bat

windows7_x64

10

core.bat

windows10_x64

10

group_32.tmp.dll

windows7_x64

10

group_32.tmp.dll

windows10_x64

10

Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    24/11/2021, 17:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    group_32.tmp.dll
  • Size 64KB
  • Sample211124-vln8ssgdf6
  • SHA256 7c8185c7f9fa5f7b2e402fbf5831fde7fa1c23fda6684472d137ebacf6888571
  • MD5 SHA1 SHA512
Score
10/10
icedid2237127122bankertrojan

Malware Config

Extracted

Family

  • icedid

Botnet

  • 2237127122

C2

  • lokidasterreno.site

  • burgomustopr.rest

  • lopityr4.pw

  • rocesdilin.top

Attributes
  • auth_var

    6

  • url_path

    /posts/

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\group_32.tmp.dll,#1
    1⤵
      PID:1648

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/1648-55-0x00000000002A0000-0x00000000002D7000-memory.dmp
          Download