Analysis
-
max time kernel
40s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 10:02
General
-
Target
o5p0se/o5p0se.dll
-
Size
675KB
-
MD5
b921650c429c994bc1e727607e725d23
-
SHA1
b8845c28e13925972646b5e1b4f1aa745ca96463
-
SHA256
3186e010f87176017d0cea8e23660b99ad5997261b2137abe42c9450671c6661
-
SHA512
deea8521e345f206e3822d1fdb696d5504db12e5e9256b5b70afc33d4f5d11a32a04e841d10798369088f0bf62eb8b2aec4857482339e1a8e115cb09d6f0a160
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
1060798742
C2
carismorth.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\o5p0se\o5p0se.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2024-54-0x0000000180000000-0x0000000180009000-memory.dmpFilesize
36KB