Analysis
-
max time kernel
119s -
max time network
175s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15-02-2022 07:03
General
-
Target
c6765b0c795af907637ebc5e0703a285b44041e96d43e81922f8601a2346cafa.dll
-
Size
583KB
-
MD5
7d1233f06811c1baaac3cd45ac6248f7
-
SHA1
a8a213d13e6e91954bd7e46158bf96ef52695bfe
-
SHA256
c6765b0c795af907637ebc5e0703a285b44041e96d43e81922f8601a2346cafa
-
SHA512
b2e02bc7a2f66b4570493b61a70e3793e75c67d03711ea8196cff6397908941e2a69177580cba7a7022a769df3dd5fc1823115e409fd3f1d26329bfd0f26ff59
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
412701809
C2
hdtrenity.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c6765b0c795af907637ebc5e0703a285b44041e96d43e81922f8601a2346cafa.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1616 -s 2442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
60KB
-
Filesize
4KB