Overview

overview

10

Static

static

DH-1642109849.xll

windows7_x64

7

DH-1642109849.xll

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    DH-1642109849.xll
  • Size 70KB
  • Sample220113-1kewmacfd6
  • SHA256 415abfb2785209977e7293d58e6ec29345a1be9dc343ae69f17e96c5346f9fe7
  • MD5 SHA1 SHA512
Score
10/10
icedid497724135bankertrojan

Malware Config

Extracted

Family

  • icedid

Campaign

  • 497724135

C2

  • ovedfromasi.top

Targets

    • Target
      DH-1642109849.xll
    • Size 70KB
    • SHA256 415abfb2785209977e7293d58e6ec29345a1be9dc343ae69f17e96c5346f9fe7
    • MD5 SHA1 SHA512
    Score
    10/10
    icedid497724135bankertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks