Analysis
-
max time kernel
92s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-07-2022 18:51
General
-
Target
3d484699be6b28b0edd4a3e55647beff.dll
-
Size
424KB
-
MD5
3d484699be6b28b0edd4a3e55647beff
-
SHA1
d6f7ea8695c61d3894b8f382e08974cd79da7d74
-
SHA256
7e73e4c5cba972050590b768c5612cbf0bcb3ea963ac6286a23608a067e65fcc
-
SHA512
ab30b586d4e3609a6afb2567c408f72c057e0adf5f2f963917f079d3c008e69f0cae46362f0711f9195c79a0f0a178ef31aabbc2963ae38b8e5bccaf4094276b
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
3635541348
C2
piponareatna.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3d484699be6b28b0edd4a3e55647beff.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1760-130-0x0000000180000000-0x0000000180009000-memory.dmpFilesize
36KB