Analysis
-
max time kernel
134s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
19-09-2022 16:40
General
-
Target
lxLoqZul.dll
-
Size
452KB
-
MD5
93e4b4fd7a07227f07a610790b8e250b
-
SHA1
ecbe925735cbfa4685ed265bb92177fc821b7b2f
-
SHA256
056d807ab2d077efaf148ca7c2f350710a92c795ec100c0c28fc95d2bb566d8d
-
SHA512
10de87b22b851d0ef741ea290fdd640c98b8fea9f30c6294cf1051a8e30b887edfd5894de4a77fd842692567ca8ef7fb4c8ec7c5c3ef5e01035c75d2d8c513cd
-
SSDEEP
6144:FcwOnhu0n/yvHtFxTv80J0TET7FWQ+ItFMu5P1rh/I9I1ezFxsbxBFtfCnYL6354:FkyfS0Gn21epxsvqYL85om8
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
775636601
C2
aviadronazhed.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
Blocklisted process makes network request 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lxLoqZul.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
-
Filesize
24KB