icedid | 08f11f5a595573397fe6b5aa043cc34fb6f0e8496f8633bce60c2f69d422336b | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29/03/2023, 07:00

Sharing

Report Analysis Logs

General

Target

excruciating.dll
Size

167KB
MD5

a728f31de3f5c9e2a57696ceafb481fc
SHA1

5f9024db8e28bb937f4290ebb173b07d70b48ca9
SHA256

08f11f5a595573397fe6b5aa043cc34fb6f0e8496f8633bce60c2f69d422336b
SHA512

e7084bfdcf680d1be3ed3fab7714af7c622bf585760ed76847dc3c11e0146fb25ef3abc5374c406b9fcf9a26acbdcaaf5d114a82db839ea98d5a3263c1262073
SSDEEP

3072:xVBiJdZe7QFSGwMA8VMXGQC5iYIDqHBiCI2kpZ6LoysDbvB63:Bg2jMA8VMWlEOEZJjvB63

Score

10^/10

icedid 2245380894 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

2245380894

C2

trakonicwe.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2020	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2020	rundll32.exe
2020	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\excruciating.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-54-0x000007FEF76E0000-0x000007FEF770E000-memory.dmp

Filesize
184KB

Download
memory/2020-55-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/2020-62-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download