Analysis
-
max time kernel
135s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
11-12-2022 23:03
General
-
Target
533c15177d35e0b7b5787913372a24e695e7002ef39baa548a1739b529022f30.dll
-
Size
13KB
-
MD5
c9868fc23a7d334c67d737edcfe9fcc5
-
SHA1
fa3cc12178641cb083f824a3b4964c9c96aa3d98
-
SHA256
533c15177d35e0b7b5787913372a24e695e7002ef39baa548a1739b529022f30
-
SHA512
2ce774f576dcd78587a893820f4d19aa92334b4d4c7fb0caf8f3c1c8c6f5542535ae6e6d7def7cf1a685f551c2d80d7521633166e950ecdbdacb22ef775a7337
-
SSDEEP
384:J5Jxayczq7Yjt9lfle9s6PLtB4c6kYGi8:J5DHYeIlfle9HDt2Si
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
1441853872
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
Blocklisted process makes network request 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\533c15177d35e0b7b5787913372a24e695e7002ef39baa548a1739b529022f30.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses