Analysis
-
max time kernel
93s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
31-05-2022 07:44
General
-
Target
6295c6b8ed173.dll
-
Size
480KB
-
MD5
fb52f6baf931b68def54efe08733bbff
-
SHA1
4a27c3368a742b39765a8ce755fb0f1e00d1c0b5
-
SHA256
344b6a7c3888aed4239480b4b79381bdf995e0ab8103f982912d1b769d2a8ec2
-
SHA512
4f9d81572b7c72a59a77975e6b8877217b5684a2fd6c66fc51935b4b0e55690cad66e60d9d2d864c5ff02a86935c86878524a154f89f58d90142101b76f52230
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
2581925242
C2
uleoballs.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6295c6b8ed173.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4144-130-0x0000000180000000-0x0000000180009000-memory.dmpFilesize
36KB