icedid | 02ca1b0e4025a81f5fdb000591750d72e28551dba49aa26ea5f39d68d6597777 | Triage

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11-11-2022 05:40

Sharing

Report Analysis Logs

General

Target

belts/anyhow.dll
Size

91KB
MD5

13563c9b38c5aa0e0efbd7b3fbbbb32d
SHA1

fb6d2a7852d1b447a0fc2d1fd18108d81639ef91
SHA256

64598e2bc1c0f58636825193c93405d555a5fcd87816ec22842125629d3136ad
SHA512

a07559208fa4dd280ca53133d08fcd82430c36d19a890cdf2eedfdedb3e98235c10c5dfb0967354929da684f6e51dff712f4da819af71dd81453a6ed32c9f3f2
SSDEEP

1536:vXREXIBJWIsBMwYrUvjwI7CdiZEkgusxGEgG+JWx+1GlR:ZicWIsBiUcI7CWrgus49KxJlR

Score

10^/10

icedid 426369791 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

426369791

C2

ahilacarstrupert.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

2 1880 rundll32.exe
4 1880 rundll32.exe
5 1880 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1880 rundll32.exe
1880 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\belts\anyhow.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1880-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1880-60-0x0000000000110000-0x0000000000116000-memory.dmp

Filesize
24KB

Download