icedid | 31370fb95522ce04df9727adc3e3b1bd6c7b222fe9b0532b8273d065fe73fd38 | Triage

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
06-06-2022 12:22

Sharing

Report Analysis Logs

General

Target

82e07bd3ecada519802984139c213db4332bbc49b61509a6b40b7142c28f4900.dll
Size

464KB
MD5

6dff622395b320b2a1947480d697d3c0
SHA1

b2d90b643749b06d6ae98e71205cab2e67bc1d56
SHA256

82e07bd3ecada519802984139c213db4332bbc49b61509a6b40b7142c28f4900
SHA512

59be37e0dfd5fef04763a51e449265a25176401a58b35b7b28016e99a6860437ed8985b0ffb14182eb8df2c61943a54a0bbab38466d67946ef652b5d107ded11

Score

10^/10

icedid 3681413287 banker core_loader trojan

Malware Config

Extracted

Family

icedid

Botnet

3681413287

C2

vadgeatemoz.com

akernilon.com

westdudil.com

leatyeals.com

Attributes

auth_var
3
url_path
/news/

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1012 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\82e07bd3ecada519802984139c213db4332bbc49b61509a6b40b7142c28f4900.dll,#1
1⤵
- Suspicious use of FindShellTrayWindow
PID:1012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1012-54-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download