icedid | 2dee42403c2f403a9cfcb34ca951a8e35acf790186892da646f5640e94b0195c | Triage

Analysis

max time kernel
125s
max time network
132s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 18:04

Sharing

Report Analysis Logs

General

Target

agency_kepped_jounced.dll
Size

56KB
MD5

3e1b72b890f33d2e4103ba4d8b355232
SHA1

d2dcc8c99b63ba04d32ad6dfa32ad232c1c1744c
SHA256

2dee42403c2f403a9cfcb34ca951a8e35acf790186892da646f5640e94b0195c
SHA512

7d887b6f57d77a1d1c612fe137e82449c2e3f3b3ea0c9c051e49dee30253e81437617b3083ad96585526937575f86af70726a8b57c697e32062ff755b55b4f64
SSDEEP

1536:vEJQEtAoXSQ4Vz3nGDS2+abcLNpjx/NyhqH15QoArSyACXg:MJLjXSQ636dKchqzQx

Score

10^/10

icedid 56237520 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

56237520

C2

tablearmestion.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	1348	rundll32.exe
4	1348	rundll32.exe
5	1348	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1348	rundll32.exe
1348	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\agency_kepped_jounced.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1348-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1348-60-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download