Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 16:50
General
-
Target
h1mor3/h1mor3.dll
-
Size
815KB
-
MD5
31b27506a6ece8dd09db6013e2ef2148
-
SHA1
e61221453335166db950f31a502820365ffd1dfa
-
SHA256
c1dbcc795995afe6927bf569863826844fb445de17e8e2fc1fea7531da7b2952
-
SHA512
10c81ebef645127b6e191f9798dddddf096ee7c666f5b8bb420924602a534eae5cddbedf34a245950cf3e074bbde2b3d3a8c0d5ac56a49b26fed72b1246e2d3f
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
4105767744
C2
frodupshopping.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\h1mor3\h1mor3.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1972-54-0x0000000180000000-0x0000000180009000-memory.dmpFilesize
36KB