icedid | a560238eee153b62fd9a6a01752d7e28d6409d0cd2fe1688ea5aee84b2199756 | Triage

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2022 13:27

Sharing

Report Analysis Logs

General

Target

belts/trampling.dll
Size

91KB
MD5

ca27351f9fea59e2adbd72277665e3d9
SHA1

cebae4ef3303eb1fc9053104a53706fc5841a5d0
SHA256

0b957cd40f571f1ffbbdec117ba55df508e42ec0b3ecdba8b429557d3d08c1ad
SHA512

6da0e2c5a4fb181a12a67af37a4eb4c02352dae4adc15202c89781cdfda43328193b558388aa32d2a29a8bdafc4ffb44b8f18cba2da813083405255dde2e7a6c
SSDEEP

1536:nXREXIBJWIsBMwYrUvjwI7CdiZEkgusxGEgG+JWx+1GlR:BicWIsBiUcI7CWrgus49KxJlR

Score

10^/10

icedid 426369791 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

426369791

C2

ahilacarstrupert.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

18 4876 rundll32.exe
33 4876 rundll32.exe
35 4876 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4876 rundll32.exe
4876 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\belts\trampling.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4876-132-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/4876-138-0x00000216DD760000-0x00000216DD766000-memory.dmp

Filesize
24KB

Download