icedid | c942a533bd1c751d840bcad0fcb2a0a8ef986ce1baf95bd10ca6937fcb18ed5e | Triage

Analysis

max time kernel
1607s
max time network
1611s
platform
windows7_x64
resource
win7-20220414-en
submitted
05-07-2022 16:10

Sharing

Report Analysis Logs

General

Target

768327532892733679.dll
Size

424KB
MD5

92b73d78e901480734e937cc5a6c0c9d
SHA1

bc4c1a27ae6655bab4749a5fb4d5e6908ae1b563
SHA256

219d1bd045d7c3328184aba4842cc0d36acae7e835564d84ee2d8ffea94e4317
SHA512

85b9999a86f302b6ecf4519c1873eb20095a3700dd1d50f202cb3eae790cbeb21a36c770ae32768c9fa256168164b6b2e704a316cbcd199e31262aa2093c2bc6

Score

10^/10

icedid 1825398430 banker loader suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

1825398430

C2

ciaontroni.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata

Blocklisted process makes network request 11 IoCs

Processes:

rundll32.exe

flow	pid	process
2	1016	rundll32.exe
4	1016	rundll32.exe
5	1016	rundll32.exe
6	1016	rundll32.exe
7	1016	rundll32.exe
9	1016	rundll32.exe
10	1016	rundll32.exe
11	1016	rundll32.exe
12	1016	rundll32.exe
13	1016	rundll32.exe
15	1016	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1016 rundll32.exe
1016 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\768327532892733679.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download