Analysis
-
max time kernel
126s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
08-02-2022 21:00
General
-
Target
658c58098d53a58a5ac99389167280f5d47e29ed184c6e60e19241823ce49a94.dll
-
Size
607KB
-
MD5
312c1ba3975e1ed9a0122ae2a8d1540e
-
SHA1
7bd06ef45eed15d2b2cda357840bbfa7963e5edb
-
SHA256
658c58098d53a58a5ac99389167280f5d47e29ed184c6e60e19241823ce49a94
-
SHA512
4688040f647f49736f16cc32b9f8a1203a62ab51e8409f8ed757337b21e084657b8a3db951efe97e1a4d3bea3c969fb64f2b2547c029c4606f3d9e563f7590cf
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
1732687004
C2
keepfootbal.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Drops file in Windows directory 8 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\658c58098d53a58a5ac99389167280f5d47e29ed184c6e60e19241823ce49a94.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
40KB