Analysis
-
max time kernel
122s -
max time network
133s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
18-02-2022 13:41
General
-
Target
3adc2160c304c344f6c1efcba1b759af3cc87b85376535b088adb15562aa0254.dll
-
Size
560KB
-
MD5
3a8c654dac8d89b972ca4e5d2555ba83
-
SHA1
a4c638937a14752f95bd056a9c761d85b0c24292
-
SHA256
3adc2160c304c344f6c1efcba1b759af3cc87b85376535b088adb15562aa0254
-
SHA512
de960ec64cfb1ae2299ee9444055a3d209049837af4e6a47097a0418c9e62f1b5fd06ffd1209c7a99f3a42d7b523959d02369bd714c76e23b02bacbce4698b79
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
3384076982
C2
keepfootbal.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\3adc2160c304c344f6c1efcba1b759af3cc87b85376535b088adb15562aa0254.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 740 -s 2442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
60KB