icedid | 45ccc6c4fb826261452264020c200e05a2ec4990fe8a5111fd8a777afdc9eaf1 | Triage™

Analysis

max time kernel
91s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
10/07/2022, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6bd1248ca9b95b5adeaf3ded016daf69.dll
Size 675KB
Sample220710-pl6vysdhf9
SHA256 45ccc6c4fb826261452264020c200e05a2ec4990fe8a5111fd8a777afdc9eaf1
MD5 6bd1248ca9b95b5adeaf3ded016daf69
SHA1 f8bd587215cee5152e076e642e85958c9ed0e003
SHA512 bacd01bbac29cca26b896a62512a734546cf3ccb299ab9a1b5cfa9eb384729b4a6030d23443fb5bce2dd02572c8b6e63d600327b833a5478a80c37b8fb009d4d
MD5 SHA1 SHA512

Score

10^/10

icedid 1060798742 banker loader suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

1060798742

C2

carismorth.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata

Blocklisted process makes network request 1 IoCs

flow	pid	Process
13	4552	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4552	rundll32.exe
4552	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bd1248ca9b95b5adeaf3ded016daf69.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4552-130-0x0000000180000000-0x0000000180009000-memory.dmp

Download