icedid | 0759dbf38d0703e42fd755b195123cd891e84267c46fde76332e6d31da8d02b1 | Triage

Analysis

max time kernel
139s
max time network
143s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-10-2022 08:11

Sharing

Report Analysis Logs

General

Target

sanderling.dll
Size

209KB
MD5

d902936120a6ead1482e56d42737f292
SHA1

fa458e2ff62e2a1a2038981f7ab9d73236d47816
SHA256

0759dbf38d0703e42fd755b195123cd891e84267c46fde76332e6d31da8d02b1
SHA512

d2bbfcb3244b995d31956584e052e0bb9a1e03b7c57091a2e641561a3cea31c8b3963710ff8fe34e331842e66e7a94412561d8c44f5979f35f1a63dfc856115e
SSDEEP

3072:/QCH0KDtVpkDi9bIUTAhtMjUeFIjf7E1CmsB:/nHL5VpKiKmwjf/

Score

10^/10

icedid 3447045697 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3447045697

C2

nipsontaz.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	996	rundll32.exe
4	996	rundll32.exe
5	996	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
996	rundll32.exe
996	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sanderling.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/996-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/996-60-0x0000000000100000-0x0000000000106000-memory.dmp

Filesize
24KB

Download