Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
31-05-2022 23:07
General
-
Target
0d666f4a6b4bc85553377d594d41f3a4b5e1a28d8d293694821342faf10c9176.dll
-
Size
464KB
-
MD5
c3f3b824bb6aa8b1784faf29d1503fce
-
SHA1
b2fcfd0140d3840988cd4d409668ba7fa76ea26c
-
SHA256
0d666f4a6b4bc85553377d594d41f3a4b5e1a28d8d293694821342faf10c9176
-
SHA512
80d966b71c3c90c126966a065e3a322ee6ebaa4b0c72671abde358f8303e27f48fe952d056893f931504cc38e9fc15ab8a47c6de18f08ff8c65002c0b97eb75f
Score
10/10
Malware Config
Extracted
Family
icedid
Botnet
3681413287
C2
vadgeatemoz.com
akernilon.com
westdudil.com
leatyeals.com
Attributes
-
auth_var
3
-
url_path
/news/
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d666f4a6b4bc85553377d594d41f3a4b5e1a28d8d293694821342faf10c9176.dll,#11⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB