icedid | 025df48ede2b2c9915b7dca8945680e9b60a6906a97a2b36c69b1466bc807836 | Triage

Analysis

max time kernel
291s
max time network
315s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 17:02

Sharing

Report Analysis Logs

General

Target

swore/declaims.dll
Size

49KB
MD5

5ca7eb16864b365b7c17d6c841b8c364
SHA1

4590496c195eddf69692199f66ed001a1cb25a73
SHA256

44e43e61d0636b87b8e0b57bfd2f4cebc36c613154d28238f670b2b788261187
SHA512

154503288a40ee5ee4a161ba828eb2770e987add556d84be1ea3af5f1a1b9e078dc82dda30589f8439c55b78489c48b323879b133bc58cd810af67ee93554175
SSDEEP

768:Qi9IlCuxlaboLzk8FQm5OzR4HziHF47DPh/S8bQZ2w0Nt8ASwn5:QiWl3LzPIdEzqFI7o8sZE+ASwn5

Score

10^/10

icedid 3822462527 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3822462527

C2

sciiultaelinoza.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

25 4256 rundll32.exe
65 4256 rundll32.exe
86 4256 rundll32.exe
92 4256 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4256 rundll32.exe
4256 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swore\declaims.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4256-132-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/4256-138-0x0000026C43B30000-0x0000026C43B36000-memory.dmp

Filesize
24KB

Download