icedid | e926ae4a601b8d3222cf205eb885428bc9242197e2fe2c81e059d4d83c9af860

Analysis

Target

7287387845476394829823.dll
Size

675KB
MD5

d9ca0b8b3d18b348148b81766f34971b
SHA1

eaebf971a37f05268f73611d248c6b6047d8bb13
SHA256

3ff865046c458de3a317ecedaad6aa0e60d5d36f8fcc8bfa6d4cff42efa3c3ed
SHA512

941e5d5c2c06e57bb8a88643b140332c2fbc51c9d435825576b7ac02f929c5f6f235149e382a8dbaf12c8a39afbc03e3526cb582b43b026ced33e24e88d02551

Score

10^/10

Family

icedid

Campaign

1175749654

hlansmagazine.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1464 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1464 rundll32.exe
1464 rundll32.exe

flow	pid	process
2	1464	rundll32.exe

pid	process
1464	rundll32.exe
1464	rundll32.exe

memory/1464-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download