Overview

overview

10

Static

static

b1f0edb77c...e9.dll

windows7_x64

10

b1f0edb77c...e9.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    91s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    30-05-2022 15:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b1f0edb77c4d758ac264faa3dd4ea22b75592e531d7952d13c68c018d26b0fe9.dll

  • Size

    574KB

  • MD5

    c3edcc2b6eeb27aa2249d73735885080

  • SHA1

    697be28c37d08438c7ee28b0dabeb5a3bdbd17bb

  • SHA256

    b1f0edb77c4d758ac264faa3dd4ea22b75592e531d7952d13c68c018d26b0fe9

  • SHA512

    ef016607e87ab5c50a8c33c249622da25387617bbf9ded845f428e6c9164153e324772db86319c0fe3cac25aade5760577ea02378b7672c11e37195771956606

Score
10/10
icedid452507187bankercore_loadertrojan

Malware Config

Extracted

Family

icedid

Botnet

452507187

C2

ribedexperi.top

sobaprivba.rest

anuonuribids.store

teensviolet.com
Attributes
  • auth_var

    19

  • url_path

    /news/

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1f0edb77c4d758ac264faa3dd4ea22b75592e531d7952d13c68c018d26b0fe9.dll,#1
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:3336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3336-130-0x0000000180000000-0x0000000180005000-memory.dmp

    Filesize

    20KB

    Download