icedid | 87b3990d898a8ccdaf5b4ef9b4c39150e21fb120293bbbd5c139bf3ec94072a9 | Triage™

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
10/07/2022, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
698dd2bd46913360e0b8de30be941f5f.dll
Size 671KB
Sample220710-kbk4aaafdn
SHA256 87b3990d898a8ccdaf5b4ef9b4c39150e21fb120293bbbd5c139bf3ec94072a9
MD5 698dd2bd46913360e0b8de30be941f5f
SHA1 52f5d29d9fd399f7e55b5f7221abc21eb1cfceb0
SHA512 72e488b4da577f945edcae2ebf7ad5cf3d0adbcd88d17cfe4fe27f27fb5a6720db85a31d1276c6da981933355c601a0c444bf14f2fd3d62d2434114ffba27fdd
MD5 SHA1 SHA512

Score

10^/10

icedid 1060798742 banker loader suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

1060798742

C2

carismorth.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	1280	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1280	rundll32.exe
1280	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\698dd2bd46913360e0b8de30be941f5f.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-54-0x0000000180000000-0x0000000180009000-memory.dmp

Download