Analysis
-
max time kernel
125s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
03-02-2023 03:35
General
-
Target
6d2389a68dabe362e1cc83907680ef143384187f42c0d3fbb55b87ed2284271e.dll
-
Size
13KB
-
MD5
6fd1466075575c24e661d4d6cf2db3fa
-
SHA1
f6f107ec7eea9ecc5cab57f1ace5566755b0befa
-
SHA256
6d2389a68dabe362e1cc83907680ef143384187f42c0d3fbb55b87ed2284271e
-
SHA512
bc74a56049d643088d2f766e4c9e74ed1ac8913a092f4128e9c7b4e0b0153b1fdc354a6b06d40d8fb0844a5859158fae52245d87f901ec133817e8820b4b817a
-
SSDEEP
192:Xu+nM5KC/zxayGc3gzq7YjDaqzJCueT+RfbZne9s6PLlGtMP0tkYGijYz:K5Jxayczq7Yjt9lfle9s6PLaQ6kYGi8
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
2255569783
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
Blocklisted process makes network request 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6d2389a68dabe362e1cc83907680ef143384187f42c0d3fbb55b87ed2284271e.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses