icedid | 420a9b53025c922bd4be1d93c2812c1d6b121575eba5d1215500c2d90aa9282d | Triage

Analysis

max time kernel
129s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-09-2022 17:05

Sharing

Report Analysis Logs

General

Target

just/thingLook.dll
Size

728KB
MD5

4949326c9ecc8b5be72a53e68da614ed
SHA1

a63dab571508dcee9844ac9ba8c36feb7da139de
SHA256

7a3f5daaf1188a7d338382e91a4eb2167f15a87d542abacf164c70a700ab4fe6
SHA512

64364896209519fa1c2c3397a39a9998ada788bf4631c38e0fa8d6919b4c2288e65e5b862764b03d11e7b9edafd25de2ea256c936c2f9312de0e0ba63d8d76cd
SSDEEP

12288:XRw7GwUwjw1wJgHwYwfw69GwHwMwMcwp8wDftkAqfw45EZUw3xCwlNwcwwGwHw9K:X8

Score

10^/10

icedid 3295293169 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3295293169

C2

pildofraften.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 3 IoCs

flow	pid	Process
11	3172	rundll32.exe
33	3172	rundll32.exe
36	3172	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3172	rundll32.exe
3172	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\just\thingLook.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3172-132-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/3172-138-0x000001AAC9DC0000-0x000001AAC9DC6000-memory.dmp

Filesize
24KB

Download