Analysis
-
max time kernel
41s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
31-05-2022 08:35
General
-
Target
f733d53791eac3af5dade593ac263ada.dll
-
Size
480KB
-
MD5
f733d53791eac3af5dade593ac263ada
-
SHA1
9231f9ed4a47c89d638947b6f5aa9c86306863c2
-
SHA256
e75fd278008b59ee6b0377088ec244e2f0f0c8ef43db19eb31070002e71fbd23
-
SHA512
d9618b35c29470992b9876226e4544f3a95786dee9f1d48de8f7c5c6941b33831a5843037608b5090e34a9f829fcc9a89d5c95fc100dbf0f60823282ba12a362
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
2581925242
C2
uleoballs.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f733d53791eac3af5dade593ac263ada.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB