icedid | b1566f9c7ffa839554b96575e2a34ea79416f03df75b5048f561e96808975555 | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
26-12-2022 19:37

Sharing

Report Analysis Logs

General

Target

180000000.dll
Size

13KB
MD5

bdc362abb981e8aa18b4c19b41efec24
SHA1

d29b9c28636513071a169fc6dd293c21de890852
SHA256

b1566f9c7ffa839554b96575e2a34ea79416f03df75b5048f561e96808975555
SHA512

513aa43c84ba824b109f726b3caf5e67c4a9e05418761592fdb7724051bd4ad5228089d7ba998deee42012aa4a6124a4a2a3dfc06c3893253cabf481f7a440d9
SSDEEP

192:6P+nM5KC/zxayGc3gzq7YjDaqzJCueT+RfbZne9s6PLSpP0tkYGijYt:s5Jxayczq7Yjt9lfle9s6PLSd6kYGi8

Score

10^/10

icedid 3146401099 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

3146401099

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

2 1684 rundll32.exe
6 1684 rundll32.exe
7 1684 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1684 rundll32.exe
1684 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\180000000.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...