Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
29-06-2022 14:59
General
-
Target
s4pesa.dll
-
Size
731KB
-
MD5
85385ece7406ae8b3628e3a27098ddb9
-
SHA1
6d9e54eaf9048628303055faf01910932bb32b9d
-
SHA256
e85bbe0699df2c1ed14d3c409d082b94a04a1839d4bd00ddcbc5cb64f9849ec1
-
SHA512
feb4e639a0d6207b1ae57e9202b79542529b0b96e9965f48f6a2fd3080c1b08f340e1bf3b82bb3fc978810de0df202e07ab33c811647f5f533dac766ec37e17c
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
3652318967
C2
yankyhoni.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\s4pesa.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB