icedid | 4db1e80508701812751119033e7be5c91c06cb0e41e5d0060799ca7b5f5aad91 | Triage™

Analysis

max time kernel
92s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
09/07/2022, 06:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6d7e61634926c470b1c0c4d82e56c339.dll
Size 534KB
Sample220709-hh292aceek
SHA256 4db1e80508701812751119033e7be5c91c06cb0e41e5d0060799ca7b5f5aad91
MD5 6d7e61634926c470b1c0c4d82e56c339
SHA1 e94db816e2c9174b6092b6b5d22182c0f715dee9
SHA512 6c5f3a042e4e5c9a032c4a0028e9310f46a48ffd1dd5447b4edd364fb86c20c374b6479c2355eff85feef330c70684f2b46850c958d6eecf074df3136924a5f6
MD5 SHA1 SHA512

Score

10^/10

icedid 227378761 banker loader suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

227378761

C2

blionarywesta.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata

Blocklisted process makes network request 1 IoCs

flow	pid	Process
12	3880	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3880	rundll32.exe
3880	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d7e61634926c470b1c0c4d82e56c339.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3880-130-0x0000000180000000-0x0000000180009000-memory.dmp

Download