icedid | daa40acf17585b2246dc1e9e6610964368f6fb854fdc16a1972c7908c23ab5cf

Analysis

Target

768327532892733679.dll
Size

424KB
MD5

92b73d78e901480734e937cc5a6c0c9d
SHA1

bc4c1a27ae6655bab4749a5fb4d5e6908ae1b563
SHA256

219d1bd045d7c3328184aba4842cc0d36acae7e835564d84ee2d8ffea94e4317
SHA512

85b9999a86f302b6ecf4519c1873eb20095a3700dd1d50f202cb3eae790cbeb21a36c770ae32768c9fa256168164b6b2e704a316cbcd199e31262aa2093c2bc6

Score

10^/10

Family

icedid

Campaign

1825398430

ciaontroni.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1452 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1452 rundll32.exe
1452 rundll32.exe

flow	pid	process
2	1452	rundll32.exe

pid	process
1452	rundll32.exe
1452	rundll32.exe

memory/1452-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download