Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-07-2022 21:10
General
-
Target
7287387845476394829823.dll
-
Size
675KB
-
MD5
d9ca0b8b3d18b348148b81766f34971b
-
SHA1
eaebf971a37f05268f73611d248c6b6047d8bb13
-
SHA256
3ff865046c458de3a317ecedaad6aa0e60d5d36f8fcc8bfa6d4cff42efa3c3ed
-
SHA512
941e5d5c2c06e57bb8a88643b140332c2fbc51c9d435825576b7ac02f929c5f6f235149e382a8dbaf12c8a39afbc03e3526cb582b43b026ced33e24e88d02551
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
1175749654
C2
hlansmagazine.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7287387845476394829823.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB