Overview

overview

10

Static

static

81267b1f7b...55.dll

windows7_x64

10

81267b1f7b...55.dll

windows10-2004_x64

10

Resubmissions

31-05-2022 13:41

220531-qy5zvsbch6 10

30-05-2022 15:37

220530-s2wxgaacg8 10

Analysis

  • max time kernel
    97s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    30-05-2022 15:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    81267b1f7bf58bd9e999083ccc6681cd62be16b81d3e5d2486ce8d150239c455.dll

  • Size

    372KB

  • MD5

    0137e3896f7d805fe348f42137cee9af

  • SHA1

    c642729dc5714595c5eba585b48b899d2a1ddc43

  • SHA256

    81267b1f7bf58bd9e999083ccc6681cd62be16b81d3e5d2486ce8d150239c455

  • SHA512

    d9710614b484e5a6ca8029dc31aa119f4843d8d69bbb1f9a4eb70d37906381732881a96657551cc96f329e9ed8d221dbf08335f6bc80d4333ffdab9696c6b1ca

Score
10/10
icedid1501064257bankercore_loadertrojan

Malware Config

Extracted

Family

icedid

Botnet

1501064257

C2

ouldmakeithapp.top

meincarton.top

callbackhubs.com

eldingdayl.com

ganjicow.com

meanforthen.com
Attributes
  • auth_var

    13

  • url_path

    /news/

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\81267b1f7bf58bd9e999083ccc6681cd62be16b81d3e5d2486ce8d150239c455.dll,#1
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:3880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3880-130-0x0000000180000000-0x0000000180005000-memory.dmp

    Filesize

    20KB

    Download