Overview

overview

10

Static

static

xxx.dll

windows7-x64

10

xxx.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    324s
  • max time network
    443s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2022 21:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    xxx.dll

  • Size

    375KB

  • MD5

    d24053e88149fee100f6d0fd88a5c118

  • SHA1

    69084f340ff60656df3a73fb9d0e3cffee9ae667

  • SHA256

    0d544614b47400768cf210c2e4d1a298e5cae36820c7b1b6327bb67b8e3ea8cb

  • SHA512

    cf8331b06f6d34b19ca817cc77c1854e6319456cc4f2d4753911711d98b439f0204a6f2278a73c521d43cf462fcf2b49a722fa7809af2954cc0e1721db4b4734

  • SSDEEP

    6144:/lvrP7tlUH7tBtGop4h1ee2k6Sn4s68dTcEgDAIpiWe97TzGux0siC6pEOEGElVP:9vrPsSo9tmNhdhr

Score
10/10
icedid1313163077bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

1313163077

C2

oilcardirtoz.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\xxx.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2856-132-0x0000000180000000-0x0000000180009000-memory.dmp
    Filesize

    36KB

    Download