Analysis

  • max time kernel
    138s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01-10-2022 17:03

General

  • Target

    disintegrator.dll

  • Size

    672KB

  • MD5

    96316a0bf1ea3bbf16e7237ac3cdb8b7

  • SHA1

    6f4dc106ca3a1eea29c71097b3d6cd9dfa3b95ed

  • SHA256

    44bb6231a0ed40b885c744714be225a18f0a9e57e7bd44a72b5966989856d0b9

  • SHA512

    35f22737640c27dd0a0b6ed3f571e5f05e1e23b3fbd1be7f969bc8bfcf1ae8b7274c13c9035743607d512f924088b920d62628e1341471b8f44a1369c6b3c8c0

  • SSDEEP

    12288:up1Mjwyhw4wH2W7o6m/wAwBwf0CM5nANy/wXwwwZwfDnzGy//0QVdrt/pI4c:ueSuK0Nn3c

Malware Config

Extracted

Family

icedid

Campaign

2399258081

C2

eysneolissionsm.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Blocklisted process makes network request 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\disintegrator.dll,#1
    1⤵
    • Blocklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    PID:1096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1096-54-0x0000000180000000-0x0000000180009000-memory.dmp
    Filesize

    36KB

  • memory/1096-60-0x0000000000100000-0x0000000000106000-memory.dmp
    Filesize

    24KB