icedid | ec794d9627f746e0de66a28f71fa89c27b436132bf58f1ec9700a5b7e5a8737c | Triage

Analysis

max time kernel
142s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2773d913e64569a968cc1abb05a36471.dll
Size

209KB
MD5

2773d913e64569a968cc1abb05a36471
SHA1

3a6ac709a68f8e2880c16bb22c2e64e37c3ba30e
SHA256

ec794d9627f746e0de66a28f71fa89c27b436132bf58f1ec9700a5b7e5a8737c
SHA512

4e7d14de3e7d4ffbf6e57c2cc75c7c3fa6a73b1371bccaa85332bd23f5026326e040711d057a2f08c76313aea9b29ed517fe90182df877f1b18df88932bbb03e
SSDEEP

3072:qQCv0KDtVpkDi9bIUTAhtMjUeFIjf7E1CmsB:qnvL5VpKiKmwjf/

Score

10^/10

icedid 3447045697 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3447045697

C2

nipsontaz.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	1592	rundll32.exe
4	1592	rundll32.exe
5	1592	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1592	rundll32.exe
1592	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2773d913e64569a968cc1abb05a36471.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1592-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1592-60-0x0000000000180000-0x0000000000186000-memory.dmp

Filesize
24KB

Download