Analysis
- max time kernel
92s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
23/08/2022, 16:46
General
- Target 981d7c76e20956a56d7296af6e26cafb.dll
- Size 343KB
- Sample220823-t91fashhe6
- SHA256 42c1d23e476dbdefe9c123e57b5fd8e600bddaf38951a20bcf86e89a052e17bf
Score
10/10
Malware Config
Extracted
Family
-
icedid
Campaign
-
3071892330
C2
-
toughflatlying.com
Signatures
- IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
- Blocklisted process makes network request 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\981d7c76e20956a56d7296af6e26cafb.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1992-132-0x0000000180000000-0x0000000180009000-memory.dmp