General

  • Target

    p3roms.dll

  • Size

    731KB

  • Sample

    220629-xag2fsbhhp

  • MD5

    cd544b0dd2c06aee8ae6453b945a379d

  • SHA1

    0f0c97334a38ade5f7c245b1c0ee9046b9b73609

  • SHA256

    431d800fb8243fef043f01f72aabd1e1c6e7ca7e690839aa59002cd9e03970b1

  • SHA512

    4e25ce3eaf0488c94b4fab81cc331d09d500c674c731062cef3749830e4a68b1d9666d26e8b3f333de30f202751a513113afdd127405a802cf4ace0dd5d635e6

Malware Config

Extracted

Family

icedid

Campaign

3652318967

C2

yankyhoni.com

Targets

    • Target

      p3roms.dll

    • Size

      731KB

    • MD5

      cd544b0dd2c06aee8ae6453b945a379d

    • SHA1

      0f0c97334a38ade5f7c245b1c0ee9046b9b73609

    • SHA256

      431d800fb8243fef043f01f72aabd1e1c6e7ca7e690839aa59002cd9e03970b1

    • SHA512

      4e25ce3eaf0488c94b4fab81cc331d09d500c674c731062cef3749830e4a68b1d9666d26e8b3f333de30f202751a513113afdd127405a802cf4ace0dd5d635e6

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks