Analysis
-
max time kernel
91s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
31-05-2022 13:46
General
-
Target
62961b50b3d5f.dll
-
Size
480KB
-
MD5
1047e351ca7d515f75c17aec82e78462
-
SHA1
38ae2f582dbb29a6797aedcdf6c13007b5cfcc45
-
SHA256
1c6ec12d7447deae0f13d2c96e3546bc39af1b13f64a2ee7307ad95b9a30302f
-
SHA512
3363b043a41640f60a9de64f9404040533b452e3c8b1e42fa5a12eda586ddcb7e6f5879008f86161089c4acae661516c2b92e632fae409ad1bb6f3b7391d1982
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
2581925242
C2
uleoballs.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\62961b50b3d5f.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB