icedid | 12a72c6ffd55a21b0a509cfc54ab19e1f8595ad55340faec23017fcacdc0519d | Triage

Analysis

max time kernel
131s
max time network
137s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14/09/2022, 13:44

Sharing

Report Analysis Logs

General

Target

thimblerigging.dll
Size

138KB
MD5

06cbc7d413c70e96ebd00aecd20c9843
SHA1

a0b72bb3679377ebc6a847775b0c3cc01b0d8924
SHA256

12a72c6ffd55a21b0a509cfc54ab19e1f8595ad55340faec23017fcacdc0519d
SHA512

fe629ab36de4eb699221590343670015304398bcadad60065977dfb362948d0db64ad56041955f22d350170a68b5a1b61415240233ced9aac0caf34615d35af7
SSDEEP

3072:41ebJvuhflMvwj8STi6QS8vaipubgXvuvwXdAqxv:oebJvuhflMI+63YXcgXGvyAU

Score

10^/10

icedid 595980606 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

595980606

C2

qvantumbrakesz.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	1612	rundll32.exe
4	1612	rundll32.exe
5	1612	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1612	rundll32.exe
1612	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\thimblerigging.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1612-60-0x0000000000120000-0x0000000000126000-memory.dmp

Filesize
24KB

Download