icedid | 0a63a9f39e34606aca142d9a5ed264d6d0006002116a4bbbc813f208828245d3 | Triage™

Analysis

max time kernel
92s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2022, 16:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
at/aNewWouldSomeShe.dll
Size 240KB
Sample220809-t2v6lschgk
SHA256 022472fd238d945afa6ad6846611b7e6b5efdeecdea849231457c68970995008
MD5 d72c840960590bf69ef61e98ef4eca4c
SHA1 0082467371e8af5e7994685f6d14fa4286782fd8
SHA512 84ed916e243715e5827b2a7856e910f0c7ed82ff262942607bd178db0494205b1cd466c778029f7e37e31375177dc721dca31fc9b12552bfc306da27cc0c23c8
MD5 SHA1 SHA512

Score

10^/10

icedid 4277954051 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

4277954051

C2

abegelkunic.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 1 IoCs

flow	pid	Process
20	4704	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4704	rundll32.exe
4704	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\at\aNewWouldSomeShe.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4704-130-0x0000000180000000-0x0000000180009000-memory.dmp

Download