icedid | 98761de8cb4e91079b0c34a1e5558dba347d976fc0ab0250a9f66ad706a93db9 | Triage

Resubmissions

02-10-2022 15:25

221002-stk51adhdn 10

30-09-2022 13:52

220930-q6sdqsdga9 10

Analysis

max time kernel
163s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 15:25

Sharing

Report Analysis Logs

General

Target

cadets/possibilities.dll
Size

476KB
MD5

d4250398ad351bbde21d0b9acd4c6f12
SHA1

a6b204bc1dda01d0bad2423d1ca527388dc5b579
SHA256

3d271140429827ae54c9261a68dd73ce9a7def6257168b534ec367e5df160bda
SHA512

298b6d30ddf97def2e5ae0a0bf09dade093c99e64e261004a23d9a47376a0a7ae7beaef44b399cf33946cf820329cd9a1adcd958a8c950cfd2f926b73dfe6dc4
SSDEEP

6144:mnUq1i6qMhmPGx96QeQSIpBYMeepMRT9xa5yqwT:iUq1i6qbGx4IpheepMFLaAqM

Score

10^/10

icedid 3228182693 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3228182693

C2

tezycronam.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

6 2264 rundll32.exe
27 2264 rundll32.exe
52 2264 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2264 rundll32.exe
2264 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cadets\possibilities.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2264-132-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/2264-138-0x000001B4C46E0000-0x000001B4C46E6000-memory.dmp

Filesize
24KB

Download