icedid | ee5312fbda6ed062279d0bf01c5c44bb45d113aae679c3929507419e0c2d2005 | Triage

Analysis

max time kernel
104s
max time network
111s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 13:46

Sharing

Report Analysis Logs

General

Target

2b20fef22a6d9078dd2c95a07bc86221.dll
Size

209KB
MD5

2b20fef22a6d9078dd2c95a07bc86221
SHA1

6158769fcbf0f45acb93239bf63581ba76e7d98a
SHA256

ee5312fbda6ed062279d0bf01c5c44bb45d113aae679c3929507419e0c2d2005
SHA512

5632720bc88c2612ae62cc7e2dfb6cb26352153af149652c8a5403b5e505c93dc9f20ba0a357ffdbc1615473337abc37a9dd19e2bc2d4b76810f70d24f61f0c3
SSDEEP

3072:EvjzFD+vHhMTUe0FQgJYAh9apwYUVeNj6OO9I:wzFSvgT+aSe5oI

Score

10^/10

icedid 3447045697 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3447045697

C2

nipsontaz.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	1256	rundll32.exe
6	1256	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1256	rundll32.exe
1256	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b20fef22a6d9078dd2c95a07bc86221.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1256-60-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download