icedid | 8cd135e5b49d16aceb7665b6316cd4df2e132ef503ff0af51c080bad7010efd6 | Triage™

Analysis

max time kernel
85s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2022, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
y2D56.tmp.dll
Size 352KB
Sample220811-2c27madbdp
SHA256 8cd135e5b49d16aceb7665b6316cd4df2e132ef503ff0af51c080bad7010efd6
MD5 363777daf36e9534762d30bd4bf22c74
SHA1 ea94d9afd355dd23a069f21b3562d85a4266da4f
SHA512 c8cac2963c8454890483823738e5adcaee4e945839b64d241d545d3dbc9a798fba7d923eb764cb455db2d27992915cd5f6ef9fae0b05175b7f8ae9669db93d53
MD5 SHA1 SHA512

Score

10^/10

icedid 3570055661 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3570055661

C2

alexbionka.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 1 IoCs

flow	pid	Process
20	3428	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3428	rundll32.exe
3428	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\y2D56.tmp.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3428-130-0x0000000180000000-0x0000000180009000-memory.dmp

Download