icedid | 062845e88b9be24186a4024401448343538f7710bf15841fea92d1a990e74663

Analysis

Target

r7kom.dll
Size

450KB
MD5

e4a25cb6b9f293191bc0ad3deffe5d4a
SHA1

485394d8879e792bc2714d94d7cffba1625c8898
SHA256

062845e88b9be24186a4024401448343538f7710bf15841fea92d1a990e74663
SHA512

717768dffc2425ac6ec5f057208f03fb43894045f8ca9672bd8568a895bef9e5500b30b5d9f5c4aac3cc8decd5d0557f0cd4d5d7234981815edca8aa79ca059d

Score

10^/10

Family

icedid

Campaign

3568430872

alionavon.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1016 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1016 rundll32.exe
1016 rundll32.exe

flow	pid	process
2	1016	rundll32.exe

pid	process
1016	rundll32.exe
1016	rundll32.exe

memory/1016-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download