icedid | e04b950907edb3689ce7656eb199680f48c19ed029b72790be07b585e5cd4f10 | Triage

Analysis

max time kernel
91s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
02-06-2022 22:00

Sharing

Report Analysis Logs

General

Target

5ce554f6152890ef43fe424a349dbbcf5c4f2fe53e070d2a5d40b9d21f3b7b5e.dll
Size

575KB
MD5

381b8a76803ebf4f1d1180b07d440c54
SHA1

b859aab34840f149693df74778ec7a703c9a106d
SHA256

5ce554f6152890ef43fe424a349dbbcf5c4f2fe53e070d2a5d40b9d21f3b7b5e
SHA512

66eab9be5c0b1264038d8ab04c12b7cdb3cf105ded5d30de621ae6916f6ea0dce5beeea827f1d70da2094702c4ef5c41e6c2cb70fb233aeb4b8d9112e86048d3

Score

10^/10

icedid 1129175425 banker core_loader trojan

Malware Config

Extracted

Family

icedid

Botnet

1129175425

C2

intonthsnstr.rest

estoptionicou.top

ypothesisabo.top

flipperzillo.quest

Attributes

auth_var
12
url_path
/news/

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1564 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ce554f6152890ef43fe424a349dbbcf5c4f2fe53e070d2a5d40b9d21f3b7b5e.dll,#1
1⤵
- Suspicious use of FindShellTrayWindow
PID:1564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1564-130-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download