icedid | cae719eb6d79919ff8ea80bd07c060e6e6c4e3af346f237495254f72fb049b61 | Triage

Analysis

max time kernel
134s
max time network
137s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-09-2022 15:08

Sharing

Report Analysis Logs

General

Target

ricocheted/trolleys.dll
Size

358KB
MD5

fce4595c14985d9e891eda2be3824079
SHA1

362ada53842948089d6567a42c67744877fd1c7d
SHA256

3ab1572c68f1edce3e0f278900d3330c7c18f1964934ba0d5eefab57ebb9c01f
SHA512

1f195abae1ebc7cec3c285db0eb134330468a6e03b786804375d2a94291da666d019157061d827b3c48fa17ae7f7584355770c915d8ccd7177e90ab10c6ad08f
SSDEEP

6144:l6HdvqSwNOTzZLen7qACQ9j6pSHP7csiU302dw9qOL:MPLQHP7AX2djOL

Score

10^/10

icedid 2432960414 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

2432960414

C2

zalikomanperis.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

2 900 rundll32.exe
4 900 rundll32.exe
5 900 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

900 rundll32.exe
900 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ricocheted\trolleys.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/900-60-0x0000000000120000-0x0000000000126000-memory.dmp

Filesize
24KB

Download