icedid | 8f11dedd768f84aca417415ac6aafbae2ce6fcb52e5faf19f348c4b71f87522a | Triage

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-11-2022 10:14

Sharing

Report Analysis Logs

General

Target

maximally.tmp.dll
Size

91KB
MD5

973c90300aac68b64fdcc53eea3e3042
SHA1

5deea28b7446c6e7f181068db1c10eb6b4db5a0a
SHA256

8f11dedd768f84aca417415ac6aafbae2ce6fcb52e5faf19f348c4b71f87522a
SHA512

78da61c6c6c8481d31caf6b0ff900c21f7fb5957a9410ae29ac3cc6a93e8574c807d71a1ad7490f09e89a93255be54c571b99244b2a79805594372ad06665c73
SSDEEP

1536:Zet0Ij7MlNXRNRLCRw8FBR0Q6xpeweizs2Xm9+WROCzXiSLuhSiy:JInMX7GweBW/0weN22briS4M

Score

10^/10

icedid 426369791 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

426369791

C2

ahilacarstrupert.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

2 1280 rundll32.exe
4 1280 rundll32.exe
5 1280 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1280 rundll32.exe
1280 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\maximally.tmp.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1280-60-0x0000000000110000-0x0000000000116000-memory.dmp

Filesize
24KB

Download