icedid | 7165785dfa943c4301d3c41fe534e1e640558dd2cf1472d91563859473c49482 | Triage™

Analysis

max time kernel
126s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2022, 14:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
so2ra4.dll
Size 318KB
Sample220725-rqd2vaaec6
SHA256 27034a7c21b1b1fbc471104f3ffb804974886653e73b958dba2a671e27c64e04
MD5 6133bfa54f1ac476b1fdc581570bce34
SHA1 d4da7922d963747197e166476363375bd678dd56
SHA512 03147aca9ae4f9cef1fb02ba29d8701053de4720d84ce6daf8b8c3bc648b958eb1b7ced2a1e15973fe1ac7f742b3863091af50d53ab36b48dcabac0f3025bbdf
MD5 SHA1 SHA512

Score

10^/10

icedid 4149266980 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

4149266980

C2

floatascentry.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	4716	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4716	rundll32.exe
4716	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\so2ra4.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4716-130-0x0000000180000000-0x0000000180009000-memory.dmp

Download