Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
28-06-2022 17:59
General
-
Target
r7kom.dll
-
Size
450KB
-
MD5
e4a25cb6b9f293191bc0ad3deffe5d4a
-
SHA1
485394d8879e792bc2714d94d7cffba1625c8898
-
SHA256
062845e88b9be24186a4024401448343538f7710bf15841fea92d1a990e74663
-
SHA512
717768dffc2425ac6ec5f057208f03fb43894045f8ca9672bd8568a895bef9e5500b30b5d9f5c4aac3cc8decd5d0557f0cd4d5d7234981815edca8aa79ca059d
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
3568430872
C2
alionavon.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\r7kom.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB