Overview

overview

10

Static

static

luuhpi32.dll

windows7-x64

10

luuhpi32.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-08-2022 20:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    luuhpi32.dll

  • Size

    370KB

  • MD5

    21702934870f6925ce3966b2a5abe53c

  • SHA1

    fe6fa890f1b646b0c5b66741b05b361aa05b49ce

  • SHA256

    fdb13957fca26ab5ee2743c32a261c325941f74f1834687e03add970535f1c7f

  • SHA512

    cddca10923129ad05885c43b3afc451aba62bc1a6fcf69681c750167891256442e65405fa4542be9e85c3731345a55f241c239c880d7b086ca8e821eb95d3a3e

  • SSDEEP

    6144:EE5yLwbsyjHvomnVhuj+s4sfnVWpB7QH2CBAdo24rn25ZRSAD24rn2ExihwfIzhi:15mguj4MnVWpmHT24rn25ZAAD24rn24L

Score
10/10
icedid1573268852bankercore_loadertrojan

Malware Config

Extracted

Family

icedid

Botnet

1573268852

C2

peranistaer.top

gruvihabralo.nl

ultomductingbig.pro

alcoheyteri.click
Attributes
  • auth_var

    24

  • url_path

    /news/

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\luuhpi32.dll,#1
    1⤵
      PID:5056

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/5056-132-0x00007FFB1D340000-0x00007FFB1D39F000-memory.dmp
      Filesize

      380KB

      Download
    • memory/5056-133-0x0000000180000000-0x0000000180005000-memory.dmp
      Filesize

      20KB

      Download