icedid | 01788bbf12799bd7f3c2b60435dd1bb55623ed93af37d1e1ef34bdf4aa3f680d | Triage™

Analysis

max time kernel
148s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2022, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01788bbf12799bd7f3c2b60435dd1bb55623ed93af37d.dll
Size 352KB
Sample220811-s77adshbbk
SHA256 01788bbf12799bd7f3c2b60435dd1bb55623ed93af37d1e1ef34bdf4aa3f680d
MD5 784cc33407738aa21e956b753b0dd6cc
SHA1 d5bb169e368b791e246d7cd6e0b903dcea1628c6
SHA512 dbb8d7738611412d9c579ecba188a17e2b99bf7dec1601b53fdd207274b5804f32e85efcbc22abc60367aced5f6b22b8492fce5b7da962b06407e1886f529279
MD5 SHA1 SHA512

Score

10^/10

icedid 3570055661 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3570055661

C2

alexbionka.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 1 IoCs

flow	pid	Process
20	864	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
864	rundll32.exe
864	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01788bbf12799bd7f3c2b60435dd1bb55623ed93af37d.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-132-0x0000000180000000-0x0000000180009000-memory.dmp

Download