icedid | 6302f08805736a80b939c7b4e226bc7c0201c8ea567f0aaa5ac058c87c6c829f | Triage™

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
10/07/2022, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d39f2d793cf4c44d27d10dd53bf8b25.dll
Size 671KB
Sample220710-keregaaffj
SHA256 6302f08805736a80b939c7b4e226bc7c0201c8ea567f0aaa5ac058c87c6c829f
MD5 0d39f2d793cf4c44d27d10dd53bf8b25
SHA1 54435ecd9efad8ac9d8938668487877136bbfbf8
SHA512 42d88ee9adb8bad2c3e1651681e2111555a4f61781587c340295f29715905c1b76b0ee0ed37e281817cbdc655a62ee38bb1ee88081705cf1ddba47899598f731
MD5 SHA1 SHA512

Score

10^/10

icedid 1060798742 banker loader suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

1060798742

C2

carismorth.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	1644	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1644	rundll32.exe
1644	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d39f2d793cf4c44d27d10dd53bf8b25.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-54-0x0000000180000000-0x0000000180009000-memory.dmp

Download