icedid | 29705ff06be2bb3df0f87c8138f2f42e897d114fa53f516153f4e433722e1111 | Triage™

Analysis

max time kernel
51s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2022, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd9aa1bcf743985bf6f6f1e0a1019166.dll
Size 96KB
Sample220724-p6khfsdda5
SHA256 29705ff06be2bb3df0f87c8138f2f42e897d114fa53f516153f4e433722e1111
MD5 bd9aa1bcf743985bf6f6f1e0a1019166
SHA1 9e256a2ae52544b23b758e8c3dbb7e396490571c
SHA512 fb3829f65d907f937351ac6deab676058cadfb043461de7e565dd64e8ba4946653784ee7bf1ab4a65d3bfcd746b44019f07003644012e78e40d43bc380d3f57b
MD5 SHA1 SHA512

Score

10^/10

icedid 2937671378 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

2937671378

C2

cootembrast.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2168	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2168	rundll32.exe
2168	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd9aa1bcf743985bf6f6f1e0a1019166.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-132-0x0000000180000000-0x0000000180009000-memory.dmp

Download