icedid | 5b9bbb2e3bcbf2524e38b2c3b637b1485ee2205bdfd8bdfe896f7cfe9c6d041c | Triage

Analysis

max time kernel
133s
max time network
138s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-09-2022 23:04

Sharing

Report Analysis Logs

General

Target

scabs/unsecretive.dll
Size

317KB
MD5

b672e45585d248081b8cb139d2c288eb
SHA1

c3e85867915e88847285a4a3cc7c89323b17d0cc
SHA256

5dabc0ba2aee46df76b91392d4c64e6ff8e2f77f2276113169e8c01e9edc3ffd
SHA512

b04e2d9b662e652191b4a2c7d4fcd78b4322204b6156932b5e136ee6448f20f606d187c471ff4d580ba87232352c2c52514401053d3f57b287f85c43ea28d27d
SSDEEP

6144:rtA2m2kP7+sOjcroyI0xwlh8boidmQp1tRdnjU8bv:rW2/kP7yj1kuvcU8L

Score

10^/10

icedid 1023645195 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1023645195

C2

trallfasterinf.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

2 1376 rundll32.exe
4 1376 rundll32.exe
5 1376 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1376 rundll32.exe
1376 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scabs\unsecretive.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1376-60-0x0000000000190000-0x0000000000196000-memory.dmp

Filesize
24KB

Download