icedid | 0cc56595aa5e676ca94e8c746ecc22300321531ecec980b803267fc393c8ef8f | Triage™

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
14/07/2022, 21:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bekwJZRRmf.dll
Size 52KB
Sample220714-1k7lmsbbhm
SHA256 0cc56595aa5e676ca94e8c746ecc22300321531ecec980b803267fc393c8ef8f
MD5 978cb94a723e1e0ce78b6dfcef4bb4f4
SHA1 c3cb04a6552f36844206cefdd49e6ed41f101b78
SHA512 b68c7a87bcc0db8d4924b0dba8f26dc5119b793365fedc5e535ae74ef0fce300290d1f1203b2e965b9c890773cff56063b3e4252fa4dae49aa8f6521b9d1965f
MD5 SHA1 SHA512

Score

10^/10

icedid 1242860130 banker loader suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

1242860130

C2

bransfortrionaf.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata

Blocklisted process makes network request 1 IoCs

flow	pid	Process
14	4876	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4876	rundll32.exe
4876	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bekwJZRRmf.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4876-130-0x0000000180000000-0x0000000180009000-memory.dmp

Download