icedid | 8f3e03dd22ae5b295abf6d88bc06b139ec718461fe558cd42b786475c2f94fee | Triage™

Analysis

max time kernel
105s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2022, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
86d53d0f79158bca840b1ceb6a8fd6f9.dll
Size 96KB
Sample220724-pn834adcdp
SHA256 8f3e03dd22ae5b295abf6d88bc06b139ec718461fe558cd42b786475c2f94fee
MD5 86d53d0f79158bca840b1ceb6a8fd6f9
SHA1 8314ab6aeb5013213d3b1db4dc99a485c66529cc
SHA512 31b9d8787d47978ef66b912d332d69cb6b14d4426b34aab306d568e5a8a8a96bab666bbd62ad07f744b96199655920e23f0adac12897668ed451f61c6ca63b40
MD5 SHA1 SHA512

Score

10^/10

icedid 2937671378 banker loader suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

2937671378

C2

cootembrast.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata

Blocklisted process makes network request 1 IoCs

flow	pid	Process
23	3780	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3780	rundll32.exe
3780	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86d53d0f79158bca840b1ceb6a8fd6f9.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3780-130-0x0000000180000000-0x0000000180009000-memory.dmp

Download