Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
31-05-2022 11:22
General
-
Target
6295fa2e1d4b3.dll
-
Size
480KB
-
MD5
5fb757a75752e18aaf7841896779276d
-
SHA1
828c3a63d11563c0c85bc8efad1c60efed0b5fb7
-
SHA256
8296f7e07751f7626dc56c5f82dcce00578a8c8f9c50bf5923b69bc3f571ffc5
-
SHA512
ce653d450cd26dd4edf6e571ab734a1de6cba0f9c70e72b08ce5764b7d6407497c6892c6cab4e710e515a992a00707d56d90256cc67a9ea656e6a6fc1ddab7fd
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
2581925242
C2
uleoballs.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6295fa2e1d4b3.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB