icedid | eafe0b7e096d944aa5b53ca9c134915e3d557d4963e252415c181f39f2057279 | Triage™

Analysis

max time kernel
126s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2022, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
with.dll
Size 102KB
Sample220719-vxjsfsgdfr
SHA256 eafe0b7e096d944aa5b53ca9c134915e3d557d4963e252415c181f39f2057279
MD5 6ed95de1bbb49e1a1629b5bf0946685d
SHA1 0649d21ad8b3dbd87f46657321e586fb7076785f
SHA512 5d2ae631d6c47069a91395c42a6da2172d2ac79c5d6c70320818c3682084a6c9884c5b3092b80b1caf5a9bccf9c22a53d4281733bd76b0dd93c0871d788898d9
MD5 SHA1 SHA512

Score

10^/10

icedid 2745070743 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

2745070743

C2

cootembrast.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	1072	rundll32.exe
14	1072	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1072	rundll32.exe
1072	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\with.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-130-0x0000000180000000-0x0000000180009000-memory.dmp

Download