icedid | 9324277e605dc0ff74d719be6210d99bc3c6b031d9395e24f185181d32889572 | Triage™

Analysis

max time kernel
112s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2022, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e772e413bd34978b36c9262cd2fa77fe.dll
Size 61KB
Sample220718-dlq9qaaben
SHA256 9324277e605dc0ff74d719be6210d99bc3c6b031d9395e24f185181d32889572
MD5 e772e413bd34978b36c9262cd2fa77fe
SHA1 f6a348e3fcd859f95d70c0be4546f69f7468acd1
SHA512 8c5a7c5b44254ed20074a13fc3c8f640c59617044efe6da0836dfa7e465aab547485b46f946a7c37754cf26bfda4c8fa6c7bcbdb22fa2467184301662857f774
MD5 SHA1 SHA512

Score

10^/10

icedid 1259637749 banker loader suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

1259637749

C2

lifelightnilsa.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata

Blocklisted process makes network request 1 IoCs

flow	pid	Process
10	4772	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4772	rundll32.exe
4772	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e772e413bd34978b36c9262cd2fa77fe.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4772-130-0x0000000180000000-0x0000000180009000-memory.dmp

Download