icedid | 4565f091b2a69c0c375ecdf3eb88c50d0ca38249ae135bc1f190015037124cde | Triage

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-11-2022 06:33

Sharing

Report Analysis Logs

General

Target

ver123.dll
Size

96KB
MD5

c002be28e6c72106ce93f8afed7ddba7
SHA1

533ef4b2b8fcbe8cf8842ba7a9b35c530cfd1e33
SHA256

77f25fef713c0e8c269c71f67d6c2aa162601ef4e41433777f6c4a131528eebb
SHA512

c6239328a887c04bdbf589ddb055d530e13b9448eec24ae1cc834eeaeecb91810fa011939230683e984ff14bd0409c8687253d0f17c165626432fb679d4d784c
SSDEEP

3072:zhsRYxpnZaiZuko6XK1DK+hfN/bfw/5hT:txZpkDKo1TfI

Score

10^/10

icedid 1609463178 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1609463178

C2

trolspeaksunt.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

2 1376 rundll32.exe
4 1376 rundll32.exe
5 1376 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1376 rundll32.exe
1376 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ver123.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1376-60-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download