icedid | 0524a8fe82edc46ae041b94ce80618365fb9ddadedd29d1f4fd6c7049bc02bba | Triage

Analysis

max time kernel
142s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 18:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ice1910.dll
Size

56KB
MD5

c63f1b90ef5c65f6826349e64b00745e
SHA1

c7666564b47388a5e987431ee5c23e2db3d472d8
SHA256

0524a8fe82edc46ae041b94ce80618365fb9ddadedd29d1f4fd6c7049bc02bba
SHA512

4837ac4c859c9b09225a930a1a397b0abe19af6a850a638b1055f5be68fb724c213681f91214985ada36295ef9c231867dd6ad4366b4e36b1e77eaad1647c320
SSDEEP

1536:tpheQ8hE218U0gVCHyGmIg9XkonWEOrFck/STe/utyEO:tp+1eaXL/Ouz

Score

10^/10

icedid 56237520 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

56237520

C2

tablearmestion.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 3 IoCs

flow	pid	Process
5	2160	rundll32.exe
38	2160	rundll32.exe
40	2160	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2160	rundll32.exe
2160	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ice1910.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2160-132-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/2160-138-0x00000143F0110000-0x00000143F0116000-memory.dmp

Filesize
24KB

Download