Analysis
-
max time kernel
294s -
max time network
299s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
07-07-2022 17:20
General
-
Target
default.png.dll
-
Size
534KB
-
MD5
a1bcfdb83a0ca2a70b67c20977fc8469
-
SHA1
845a171abcca9ec8a4c58e8b9ffce78b31af42be
-
SHA256
926210300a931253b0de69be61f4bdc881aad266c3d48d6b37c25d5b549ba3ae
-
SHA512
08e4817ed5ae894ff94def35d2daa6505ab76195e9f77af6c3e795af05e06d58a4f6db355872856c6db71109c7a3c643626f21fd4132ffc01a4f2cacbdf3dc5a
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
227378761
C2
blionarywesta.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 9 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\default.png.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32 default.png.dll,#13⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
-
-
Filesize
136KB
-
Filesize
240KB
-
Filesize
472KB
-