icedid | 6f5873af4eef364bd826f17d5c872f37b14737481672746b21c1b99482e5e02b | Triage

Analysis

max time kernel
135s
max time network
138s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-09-2022 11:50

Sharing

Report Analysis Logs

General

Target

unnotified.dll
Size

317KB
MD5

4bb427783561c267c4100a4333ae45d1
SHA1

b53b87a8cb278ddecfba9950aa2911d618e40582
SHA256

6f5873af4eef364bd826f17d5c872f37b14737481672746b21c1b99482e5e02b
SHA512

5cf46393c075bcd5e0d5d57ae8559e1299137a684d1437d8a48a455f7e9a97a2d5a1cebe23df68f28c93ad950b472217977d79d6fe3155f67862e5a5a12f67b5
SSDEEP

6144:twA2m2kP7+sOjcroyI0xwlh8boidmQp1tRdnjU8b8:tD2/kP7yj1kuvcU8o

Score

10^/10

icedid 1023645195 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1023645195

C2

trallfasterinf.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

2 1280 rundll32.exe
4 1280 rundll32.exe
5 1280 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1280 rundll32.exe
1280 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\unnotified.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1280-60-0x0000000000110000-0x0000000000116000-memory.dmp

Filesize
24KB

Download