icedid | 9536f6a25cbaf7bf71d44f6cad875561d696f129f9d62cbee7581453c6013906 | Triage

Analysis

max time kernel
134s
max time network
137s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-09-2022 15:46

Sharing

Report Analysis Logs

General

Target

96614e82986f76b12dd396a986437dc4.dll
Size

317KB
MD5

96614e82986f76b12dd396a986437dc4
SHA1

5d6afa5d20ece41f062cc22330406c83c08179b5
SHA256

9536f6a25cbaf7bf71d44f6cad875561d696f129f9d62cbee7581453c6013906
SHA512

1da01d068421e6d1ad85090295fea2716d424e03e4b41ca6640cc1e22b26478da20b2c3a70a37b43295112aca03faa1eb6b3f277f2ea3ced2334e2e3719cdb46
SSDEEP

6144:iiaIMPl3fdywZzWsIRhcY2EmQ77BkP7+sPI1AF+:iiaxP58X2ikP7U1Ak

Score

10^/10

icedid 1023645195 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1023645195

C2

trallfasterinf.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

2 1824 rundll32.exe
4 1824 rundll32.exe
5 1824 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1824 rundll32.exe
1824 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\96614e82986f76b12dd396a986437dc4.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1824-60-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download