icedid | a95a630ee8cedef419fc7e6e768bf2a04236a65425ab2be20d2cd244435b4063

Analysis

Target

9084752405636544767397.dll
Size

814KB
MD5

05ccc6dc47f28478518a54752e555093
SHA1

050b0aaa276bc2f5b2e86cfe10c7425ab9652525
SHA256

a95a630ee8cedef419fc7e6e768bf2a04236a65425ab2be20d2cd244435b4063
SHA512

8c62775bc884e759a9ba656dab702f6ea9b25e6c43cdd88460d4eca711c207452e52e50f9d94cc1ecadafe11ae25a9d3309c15a9b806f1397cd1220c5277260a

Score

10^/10

Family

icedid

Campaign

2677960267

letsgivnina.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1720 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1720 rundll32.exe
1720 rundll32.exe

flow	pid	process
2	1720	rundll32.exe

pid	process
1720	rundll32.exe
1720	rundll32.exe

memory/1720-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download