Overview

overview

10

Static

static

cmd.bat

windows7_x64

1

cmd.bat

windows10-2004_x64

1

fortune_64.dll

windows7_x64

10

fortune_64.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    11-07-2022 16:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fortune_64.dll

  • Size

    46KB

  • MD5

    e242d9d06b4ee30e5fad7a4e69484626

  • SHA1

    2071fc8911b08ebd97cd499f1986d02f5f29e49d

  • SHA256

    fdf5a43c0f1f5e23d3df16fef96f046ce51006b07b05df28a03ddb90c2488b7b

  • SHA512

    b910f6987b357cc8c9178e50c1bc8a0a67728508fdd33a5d6a8149e339737410dc864f99e267e6c15733b1d497cb52efbb1f9cbd5ad1e488b7af09f3d8c367da

Score
10/10
icedid1573268852bankercore_loadertrojan

Malware Config

Extracted

Family

icedid

Botnet

1573268852

C2

peranistaer.top

gruvihabralo.nl
Attributes
  • auth_var

    2

  • url_path

    /news/

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\fortune_64.dll,#1
    1⤵
      PID:1108

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1108-130-0x0000000180000000-0x0000000180005000-memory.dmp
      Filesize

      20KB

      Download