icedid | 17a9a57035525ee568e49a9378b3f44f44e713205ac734c5d404ea5d0b75c65d | Triage

Analysis

max time kernel
135s
max time network
138s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-09-2022 16:07

Sharing

Report Analysis Logs

General

Target

b985a77773a2d5226c31af6f3a108757.dll
Size

317KB
MD5

b985a77773a2d5226c31af6f3a108757
SHA1

129aa01a276a17870bd6a4255f9db171b2dc7206
SHA256

17a9a57035525ee568e49a9378b3f44f44e713205ac734c5d404ea5d0b75c65d
SHA512

c75bbf114cdb0fc5427b4ea2ddc0284d25987ed7680f5aebc84222b8e1c3ab87f3b3d23ebf68147067d04a6d020a5845713421fdf20413d18eb6906bd2212e3b
SSDEEP

6144:niaIMPl3fdywZzWsIRhcY2EmQ77BkP7+sPI1AFH:niaxP58X2ikP7U1AR

Score

10^/10

icedid 1023645195 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1023645195

C2

trallfasterinf.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

2 1412 rundll32.exe
5 1412 rundll32.exe
6 1412 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1412 rundll32.exe
1412 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b985a77773a2d5226c31af6f3a108757.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1412-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1412-60-0x0000000000110000-0x0000000000116000-memory.dmp

Filesize
24KB

Download