Analysis
-
max time kernel
91s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
06-07-2022 17:19
General
-
Target
o5p0se.dll
-
Size
673KB
-
MD5
55d9ce94281b789ebb0f90e5cf704eb7
-
SHA1
2a0a5a1d41587efb9c927d5d2c2fe989e0b9ed08
-
SHA256
141b5ac38343d2856ee309e943cb64026d16234b70c46212d5e9febe4b95d39e
-
SHA512
8910879bc7c36b734698ff7355885c859b88cc5403098b612bb7cc2919f5980535860a9f79def1f7b6504ae937b4bf4599af7b5ca6938695c412c177997db0d8
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
1060798742
C2
carismorth.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\o5p0se.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3184-130-0x0000000180000000-0x0000000180009000-memory.dmpFilesize
36KB