icedid | 95431d74efcd74d9999ec750c7b1b9b7c3c33e916e98c8590a23d6bfc9059834 | Triage

Analysis

max time kernel
134s
max time network
138s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-09-2022 15:31

Sharing

Report Analysis Logs

General

Target

790274f5be09fc4e5add5c730f84e0c4.dll
Size

317KB
MD5

790274f5be09fc4e5add5c730f84e0c4
SHA1

5c111b3d136c8f6630a11e4b3f6e6a9c02fe62d0
SHA256

95431d74efcd74d9999ec750c7b1b9b7c3c33e916e98c8590a23d6bfc9059834
SHA512

ed4508ac397b14c28b7233bce5f889d931ad5bef9833be6fb5e6a91890f1a33ce511927d1db530f5662112b2ca95bbe09c9200ca182e239e4402b060098416ce
SSDEEP

6144:R+A2m2kP7+sOjcroyI0xwlh8boidmQp1tRdnjU8bM:Rp2/kP7yj1kuvcU8g

Score

10^/10

icedid 1023645195 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1023645195

C2

trallfasterinf.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

2 1088 rundll32.exe
4 1088 rundll32.exe
6 1088 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1088 rundll32.exe
1088 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\790274f5be09fc4e5add5c730f84e0c4.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1088-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1088-60-0x00000000000A0000-0x00000000000A6000-memory.dmp

Filesize
24KB

Download