icedid | 8cd135e5b49d16aceb7665b6316cd4df2e132ef503ff0af51c080bad7010efd6 | Triage

Analysis

max time kernel
85s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2022 22:27

Sharing

Report Analysis Logs

General

Target

y2D56.tmp.dll
Size

352KB
MD5

363777daf36e9534762d30bd4bf22c74
SHA1

ea94d9afd355dd23a069f21b3562d85a4266da4f
SHA256

8cd135e5b49d16aceb7665b6316cd4df2e132ef503ff0af51c080bad7010efd6
SHA512

c8cac2963c8454890483823738e5adcaee4e945839b64d241d545d3dbc9a798fba7d923eb764cb455db2d27992915cd5f6ef9fae0b05175b7f8ae9669db93d53

Score

10^/10

icedid 3570055661 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3570055661

C2

alexbionka.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

20 3428 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

3428 rundll32.exe
3428 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\y2D56.tmp.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3428-130-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download