icedid | 0524a8fe82edc46ae041b94ce80618365fb9ddadedd29d1f4fd6c7049bc02bba | Triage

Analysis

max time kernel
125s
max time network
130s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 18:54

Sharing

Report Analysis Logs

General

Target

ice1910.dll
Size

56KB
MD5

c63f1b90ef5c65f6826349e64b00745e
SHA1

c7666564b47388a5e987431ee5c23e2db3d472d8
SHA256

0524a8fe82edc46ae041b94ce80618365fb9ddadedd29d1f4fd6c7049bc02bba
SHA512

4837ac4c859c9b09225a930a1a397b0abe19af6a850a638b1055f5be68fb724c213681f91214985ada36295ef9c231867dd6ad4366b4e36b1e77eaad1647c320
SSDEEP

1536:tpheQ8hE218U0gVCHyGmIg9XkonWEOrFck/STe/utyEO:tp+1eaXL/Ouz

Score

10^/10

icedid 56237520 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

56237520

C2

tablearmestion.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	1724	rundll32.exe
4	1724	rundll32.exe
5	1724	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1724	rundll32.exe
1724	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ice1910.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1724-60-0x0000000000190000-0x0000000000196000-memory.dmp

Filesize
24KB

Download