icedid | 4607903b53c214940e6b09075c961fa4708c14179069230cd9d40af9c1265c47 | Triage™

Analysis

max time kernel
186s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08/07/2022, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
074871d044d606d5437d8541a64d1700.dll
Size 534KB
Sample220708-evspkshaak
SHA256 4607903b53c214940e6b09075c961fa4708c14179069230cd9d40af9c1265c47
MD5 074871d044d606d5437d8541a64d1700
SHA1 3a7e97f8deb5f103217da6d6a73ff5d22c422949
SHA512 09e59be571277e4a38e50ae14311f6915c8b8c8ef8fb12528d8ad514122f7c4efc5e5544d6c340813af07a62499a2df0b8d22410027bcc31714a211a4115c1cf
MD5 SHA1 SHA512

Score

10^/10

icedid 227378761 banker loader suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

227378761

C2

blionarywesta.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
18	4308	rundll32.exe
60	4308	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4308	rundll32.exe
4308	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\074871d044d606d5437d8541a64d1700.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4308-130-0x0000000180000000-0x0000000180009000-memory.dmp

Download