Overview

overview

10

Static

static

Invoice-tr...nt.lnk

windows10-2004-x64

3

Invoice-tr...ng.dll

windows10-2004-x64

10

Invoice-tr...ip.bat

windows10-2004-x64

1

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/10/2022, 19:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Invoice-trappings_adv-82894_ISO/cabjawbitsly/fellowshipping.dll

  • Size

    127KB

  • MD5

    b116a4f4f1f11921e4116e72ecc776e9

  • SHA1

    0fe7b18f045befc64e43ef6c5f0a684e6471549a

  • SHA256

    403e04507ba3e5a2db7b85bae0b4d4c3588bfffa4fbcdd2bf7e29c68a2543dc3

  • SHA512

    255a8c4c81404b1ae4e56d63fc872e6426a40e62736ee48f760f0e92fa75221945bb24bd820aaaf0c7bd51bbb816b3c523126ebe17965c214d1e7a54549f4bc2

  • SSDEEP

    1536:fXBU4lRA49aRkLM0CU/WuYBlukta0pooMo67L4j9H1AXcbcAfZ4BWIJ+lcNMy:PBU4lp9KkL7CiJkEro670j9H1hcwy

Score
10/10
icedid4182817597bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

4182817597

C2

salimjizita.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • Blocklisted process makes network request 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Invoice-trappings_adv-82894_ISO\cabjawbitsly\fellowshipping.dll,#1
    1⤵
    • Blocklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    PID:3480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3480-132-0x0000000180000000-0x0000000180009000-memory.dmp

    Filesize

    36KB

    Download

  • memory/3480-138-0x0000023C73D00000-0x0000023C73D06000-memory.dmp

    Filesize

    24KB

    Download