Analysis
-
max time kernel
44s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
29-06-2022 18:38
General
-
Target
p3roms.dll
-
Size
731KB
-
MD5
cd544b0dd2c06aee8ae6453b945a379d
-
SHA1
0f0c97334a38ade5f7c245b1c0ee9046b9b73609
-
SHA256
431d800fb8243fef043f01f72aabd1e1c6e7ca7e690839aa59002cd9e03970b1
-
SHA512
4e25ce3eaf0488c94b4fab81cc331d09d500c674c731062cef3749830e4a68b1d9666d26e8b3f333de30f202751a513113afdd127405a802cf4ace0dd5d635e6
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
3652318967
C2
yankyhoni.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\p3roms.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1100-54-0x0000000180000000-0x0000000180009000-memory.dmpFilesize
36KB