icedid | c705008b6656feabe462ebb2363d6a259581cea574872cb1c6c440dbd23ad4fa | Triage

Resubmissions

19-12-2022 02:21

221219-ctd4paea95 3

15-12-2022 18:02

221215-wmvbwada34 10

15-12-2022 18:01

221215-wl6nhsda29 1

15-12-2022 18:01

221215-wl1ghafh7y 3

Analysis

max time kernel
90s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-12-2022 18:02

Sharing

Report Analysis Logs

General

Target

tmpFB1E.dll
Size

269KB
MD5

c7ca67a72a6cad3fc366e6e172539859
SHA1

fd1855605f49c59a0894f7a8b848303eb099f496
SHA256

c705008b6656feabe462ebb2363d6a259581cea574872cb1c6c440dbd23ad4fa
SHA512

5727151a1e2680fd482fa8a882ead4242c1f96b4119f0c7672fc7a5b5d2df8a226b15dc69f6ce0f7ccfe17510f21a0af4c23ecb000bda6f29252daf724c16fbd
SSDEEP

6144:MTHJ5BU2WigC+/NZy40onBQ14xdN8IcfSLZ:qDB0igC+/NHBQ1SdwSd

Score

10^/10

icedid 787509923 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

787509923

C2

kamintrewftor.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

2 2292 rundll32.exe
48 2292 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

2292 rundll32.exe
2292 rundll32.exe
2292 rundll32.exe
2292 rundll32.exe
2292 rundll32.exe
2292 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tmpFB1E.dll, init
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2292-132-0x000001ED19FB0000-0x000001ED19FB9000-memory.dmp

Filesize
36KB

Download