icedid | 391863eea5a75239da3660bf63bc970af20f91bdd6ef89aa75c285a8cac1fee4 | Triage™

Analysis

max time kernel
93s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2022, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
391863eea5a75239da3660bf63bc970af20f91bdd6ef8.dll
Size 352KB
Sample220811-ttpc4ahedm
SHA256 391863eea5a75239da3660bf63bc970af20f91bdd6ef89aa75c285a8cac1fee4
MD5 1bd1ad1dcc5f5f1be425839089d75c37
SHA1 e7aeb763895ffdd43a1c6eabe8c33e67c72889f4
SHA512 3e342fc77aead42a8a83a790c3391d02c7243f619c524efd4061944b629e5539e2b73bcb2b1f917bf29ba7db83a202b4aaacc012ea6f02d9b14de3c0f60eb0fd
MD5 SHA1 SHA512

Score

10^/10

icedid 3570055661 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3570055661

C2

alexbionka.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 1 IoCs

flow	pid	Process
18	1256	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1256	rundll32.exe
1256	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\391863eea5a75239da3660bf63bc970af20f91bdd6ef8.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-130-0x0000000180000000-0x0000000180009000-memory.dmp

Download