icedid | 372a4b6ae0d12f245a76c78288e338ae32acb08347167b319dad7ce40e171435 | Triage™

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08/07/2022, 14:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c0f8c4cf574c24e616b0cf2281f9d7a.dll
Size 534KB
Sample220708-rvpddagac2
SHA256 372a4b6ae0d12f245a76c78288e338ae32acb08347167b319dad7ce40e171435
MD5 9c0f8c4cf574c24e616b0cf2281f9d7a
SHA1 16ca3715ee00aa814a7af1971dbe75e481a93e46
SHA512 4dca15b1628f8c4d8a3b71a9557ee8270da8993d788489ff06ee895904b2feec4145a5b9a3f85faacaa4428650901e18684f123ce1098938114fab5ae8fa805f
MD5 SHA1 SHA512

Score

10^/10

icedid 227378761 banker loader suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

227378761

C2

blionarywesta.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata

Blocklisted process makes network request 1 IoCs

flow	pid	Process
10	2576	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2576	rundll32.exe
2576	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c0f8c4cf574c24e616b0cf2281f9d7a.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2576-130-0x0000000180000000-0x0000000180009000-memory.dmp

Download