icedid | 49baabcb1c85c72d79fcfda449349253cdcb87abc3ab0f365847a3ed6cba6d68 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-09-2022 16:05

Sharing

Report Analysis Logs

General

Target

whalex64.dll
Size

693KB
MD5

5f9c93cc3bde2755cde50e744528238c
SHA1

9b474374ee788c23d60fc5ad1d94383b734a0a0f
SHA256

e17f446ec29eb378fdfc7edb8662a49819592a16c72891c69df6b47506525827
SHA512

0369ae1e429580a23ccf99e479cf5f00ff25f655eca7e242cb8a290c7e763d9609f11c6195b32f218604797b029a0799ea162c2c3ea3c892cde031867045a67b
SSDEEP

12288:EGOzqVhKLuC2Rkj6y8N1Arcqmtm1107uJtC9BSEF:okhKLuC2Rkj6y8N1ArcqQj7uJuv

Score

10^/10

icedid 536628885 banker core_loader trojan

Malware Config

Extracted

Family

icedid

Botnet

536628885

C2

azuretron.wiki

cantfluing.autos

Attributes

auth_var
2
url_path
/news/

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1196 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\whalex64.dll,#1
1⤵
- Suspicious use of FindShellTrayWindow
PID:1196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-54-0x000007FEFB4C0000-0x000007FEFB571000-memory.dmp

Filesize
708KB

Download
memory/1196-55-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download