icedid | d312c079c51f2bf011902df86e1ca4cac84eb7c74ff104fa48a505caa88ef2fe | Triage

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 23:10

Sharing

Report Analysis Logs

General

Target

challenge-files/challenge-files/Tetoomdu64.dll
Size

396KB
MD5

6ed61b28923f1894663174a13a9a789f
SHA1

787447b91095e8bb4f696a69c4b7cbaaf302e8c1
SHA256

3ed5d0476d1ce4fd325666072983d295609fe94c5b65d5db47a53f462ac7a4dc
SHA512

5d800fcb3ba63087d55992d9becd5db3a74ad18f75a84f2cae12faae50eb895f0482a6b3b069ddbc31033ee4f88279e4e33339a9058dac9425b628f1015c5ac7
SSDEEP

6144:xe+1VoOnuR9/G8z+TxcIPpypXSmn4UohdE1xH+f:xROMu68giIP0imXonE3

Score

10^/10

icedid 987543880 banker core_loader trojan

Malware Config

Extracted

Family

icedid

Botnet

987543880

C2

fimlubindu.top

vindurualeg.top

bigcostarikas.top

extrimefigim.top

Attributes

auth_var
6
url_path
/news/

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\challenge-files\challenge-files\Tetoomdu64.dll
1⤵
PID:1696

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1696-54-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

Filesize
8KB

Download
memory/1696-55-0x0000000000110000-0x0000000000115000-memory.dmp

Filesize
20KB

Download