icedid | bbebe2156314adb442b9610c8e652f9b87a090c66242ccc380b1b60ee1c16eba | Triage

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220414-en
submitted
30-05-2022 15:36

Sharing

Report Analysis Logs

General

Target

b1f0edb77c4d758ac264faa3dd4ea22b75592e531d7952d13c68c018d26b0fe9.dll
Size

574KB
MD5

c3edcc2b6eeb27aa2249d73735885080
SHA1

697be28c37d08438c7ee28b0dabeb5a3bdbd17bb
SHA256

b1f0edb77c4d758ac264faa3dd4ea22b75592e531d7952d13c68c018d26b0fe9
SHA512

ef016607e87ab5c50a8c33c249622da25387617bbf9ded845f428e6c9164153e324772db86319c0fe3cac25aade5760577ea02378b7672c11e37195771956606

Score

10^/10

icedid 452507187 banker core_loader trojan

Malware Config

Extracted

Family

icedid

Botnet

452507187

C2

ribedexperi.top

sobaprivba.rest

anuonuribids.store

teensviolet.com

Attributes

auth_var
19
url_path
/news/

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

852 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1f0edb77c4d758ac264faa3dd4ea22b75592e531d7952d13c68c018d26b0fe9.dll,#1
1⤵
- Suspicious use of FindShellTrayWindow
PID:852

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-54-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download