icedid | 2813a98e70299f41e2b3333a1e6ce4017d58da29a3380374cbe73bcb1514fdba | Triage™

Analysis

max time kernel
139s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08/07/2022, 06:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9fa4db23909f7c40797c7549d6b3e786.dll
Size 534KB
Sample220708-g92bdafcf8
SHA256 2813a98e70299f41e2b3333a1e6ce4017d58da29a3380374cbe73bcb1514fdba
MD5 9fa4db23909f7c40797c7549d6b3e786
SHA1 f90afc7fb9b8db5d08e9f3753362a9174973c756
SHA512 015ce97038e0d97c1eb007961769b0e6b35bb7599f3bf3b75fbfbb3847c4ab76d4238465bdfac947398ec68171b20fee577e1060703ffc1b8a6f9cc214798660
MD5 SHA1 SHA512

Score

10^/10

icedid 227378761 banker loader suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

227378761

C2

blionarywesta.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	3208	rundll32.exe
40	3208	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3208	rundll32.exe
3208	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fa4db23909f7c40797c7549d6b3e786.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3208-130-0x0000000180000000-0x0000000180009000-memory.dmp

Download