Overview

overview

10

Static

static

document.lnk

windows7_x64

10

document.lnk

windows10-2004_x64

10

main.dll

windows7_x64

10

main.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    1637s
  • max time network
    1425s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    12-03-2022 14:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    main.dll

  • Size

    1.2MB

  • MD5

    e837721973bddc2555f675f89c6121fa

  • SHA1

    5f03d305a3326fd0a7417b3a1d91e310db892f4b

  • SHA256

    2c1e2e0a9ea8e180d9323229d780590df4bd1a90781e6eebc85d9c9b0b5f41c4

  • SHA512

    fdb649c3b3f0cf36f77776fd059e6a5f19be79b2bddd66615d69b0f2633f2ee65a8ddaca3a474c899640fca1243b8f6791b89bc495c27c54929e745f134b0a50

Score
10/10
icedid2401334462bankersuricatatrojan

Malware Config

Extracted

Family

icedid

Campaign

2401334462

C2

emicthatmov.top

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\main.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:4320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4320-130-0x0000000000BE0000-0x0000000000BEB000-memory.dmp
    Filesize

    44KB

    Download