icedid | baa01161b20d3c9355387b7fa6776f8f888a2fa66f078397a704d8f68c562fde | Triage™

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08/07/2022, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e497b1492d53bda1e1d792c8d8a6ab33.dll
Size 534KB
Sample220708-n6v4hseda8
SHA256 baa01161b20d3c9355387b7fa6776f8f888a2fa66f078397a704d8f68c562fde
MD5 e497b1492d53bda1e1d792c8d8a6ab33
SHA1 4496b3283b298087d31cd3a6e4f328afebc30fb1
SHA512 79c21bf17aaacde85e56f3e5a4c8e07086a7e3bafce876236672769b3b8aff6ee810c742dc7a106292bb451f2375c8f067b2a3d9215ba1a4cba6f730b79ce771
MD5 SHA1 SHA512

Score

10^/10

icedid 227378761 banker loader suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

227378761

C2

blionarywesta.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata

Blocklisted process makes network request 1 IoCs

flow	pid	Process
9	4888	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4888	rundll32.exe
4888	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e497b1492d53bda1e1d792c8d8a6ab33.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4888-130-0x0000000180000000-0x0000000180009000-memory.dmp

Download