icedid | af607b3f29a36b96b158e5d9244553ae4042575c5f2941f55229fe8f9ae2b9a0 | Triage

Analysis

max time kernel
121s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2022, 20:06

Sharing

Report Analysis Logs

General

Target

decontaminating.dll
Size

127KB
MD5

eb7b2dc3fc139c52bb935a2dd8bba5cf
SHA1

6c0b7dda3f550d1d8ecc503c5faa91acf36214ab
SHA256

af607b3f29a36b96b158e5d9244553ae4042575c5f2941f55229fe8f9ae2b9a0
SHA512

0d46464a25af12d0ba362911164d721034a4ac7398cc05444c03f5ea88981de39f05d13f0c5055618ffaff5d93442fa8ff583b7ac85c572f9d8af65a12de5624
SSDEEP

1536:vMwa03OsvtjgoEtT44F0oGayiQ0OWAiR4BWIJ+lcNrPQIpC3Wrt9:kwj3OsF8GjMyiYWraaot9

Score

10^/10

icedid 4182817597 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

4182817597

C2

salimjizita.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	676	rundll32.exe
42	676	rundll32.exe
44	676	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
676	rundll32.exe
676	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\decontaminating.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/676-132-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/676-138-0x0000021BE0F80000-0x0000021BE0F86000-memory.dmp

Filesize
24KB

Download