Overview

overview

10

Static

static

music_leg.dll

windows7-x64

10

music_leg.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-11-2022 09:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    music_leg.dll

  • Size

    95KB

  • MD5

    d71cfe0c6d883c021098f3ab01f7fe08

  • SHA1

    4cca434a28e307a7fff8e01a7fb1c33a661551ab

  • SHA256

    5e910d228d4790cdc41ab0aaada355f9cee36b0d585be08fb359c7d2ea85b3b8

  • SHA512

    ed01319a09910d9ca0df3efe987411ddb13800ea178806e85ff62976035a7b6b0f1c8bdc4e76b2943d604a27aff385603e3dd9d179ad2ad4787c29e451c815ab

  • SSDEEP

    1536:Qy5k7TI5OMPHJ0u2+bCHxMBUZfbKIW4o5mEC6iExd3I+/7CDwrwzLNnIdJDbyHs:m7TI0MBvbCHxMMu45ECXEzYfLtM

Score
10/10
icedid1626240797bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

1626240797

C2

aurasantisflork.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • Blocklisted process makes network request 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\music_leg.dll,#1
    1⤵
    • Blocklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    PID:3796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3796-132-0x0000000180000000-0x0000000180009000-memory.dmp
    Filesize

    36KB

    Download
  • memory/3796-138-0x000001C9C5820000-0x000001C9C5826000-memory.dmp
    Filesize

    24KB

    Download