icedid | 688a5177c303494aeedff97f2d6d8ef2a54ec5aeafbb7e862e21ea684afdb2b0 | Triage

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
23-05-2022 22:13

Sharing

Report Analysis Logs

General

Target

fbfa75bf73c80f221042624aa908c9eb2f8729755d439c09a4e0f64b4c52785c.dll
Size

535KB
MD5

40d3be07121a0a81dad3232e6e7c90da
SHA1

1cecea17a0cdbdf102c41b475ba7d71270e5aab7
SHA256

fbfa75bf73c80f221042624aa908c9eb2f8729755d439c09a4e0f64b4c52785c
SHA512

65c70f630f5522a5959e547b50c08fa2e520db9d5dcff54354dc395954a51c0d2abebd8b354e0bb1d8600495816aeac32d05bc7daf6a558395f949f98d07d37b

Score

10^/10

icedid 2352744503 banker core_loader trojan

Malware Config

Extracted

Family

icedid

Botnet

2352744503

C2

drefsunl.com

fruakij.com

neonverdicto.com

ferroparromo.fun

Attributes

auth_var
10
url_path
/news/

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1464 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbfa75bf73c80f221042624aa908c9eb2f8729755d439c09a4e0f64b4c52785c.dll,#1
1⤵
- Suspicious use of FindShellTrayWindow
PID:1464

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-54-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download