icedid | 01b06d0edf88424afce8026c8cf914837212e82ab064f966dd45fa6b55882fdb | Triage

Analysis

max time kernel
266s
max time network
269s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
14-11-2022 19:45

Sharing

Report Analysis Logs

General

Target

ver123.dll
Size

96KB
MD5

d6c6c7e5747aeae222a07770bf22d2c8
SHA1

8c1c899664c82043fe583078ca567667c2c1d328
SHA256

03d1febebc88cd23690ca6885a576916f61d1c9b412d5fb661bbdcdfe9c4a9a0
SHA512

bcb9faad81b7ec7962a0ca832bc790cf953b9adca5e4749c61cc223dcea59684117b7ab1dbd880d383e33abcf5a8ed074f9ef4f0b260744bbc3195577456c32f
SSDEEP

3072:PhsRYxpnZaiZukn6XK1DK+hfN/bfw/5hT:ZxZ2kDKo1TfI

Score

10^/10

icedid 1609463178 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1609463178

C2

trolspeaksunt.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

4 4744 rundll32.exe
9 4744 rundll32.exe
10 4744 rundll32.exe
11 4744 rundll32.exe
13 4744 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4744 rundll32.exe
4744 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ver123.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4744-120-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/4744-126-0x000002DAC5B50000-0x000002DAC5B56000-memory.dmp

Filesize
24KB

Download