icedid | 0fb7388c69ef9d2d892e6edc7eff8c86ce6f6659c88d347234acaa1a382e22ba | Triage

Analysis

max time kernel
128s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2024 18:34

Sharing

Report Analysis Logs

General

Target

hey/superstring.dll
Size

728KB
MD5

293b6dc3360e7be05e35e28cc4201e47
SHA1

7d2877e3eedd5b8d366b2fe44a117a9111c3d30a
SHA256

645e011080488d4f5c14d217f5571372e7939c50a3568021cf9d434cf6f5f439
SHA512

fb9222361b530d8a279a8e1a6342b3f71f4de9674e1f904608a86e43b6641e07a8afcfd77df0ec4c7d8f4801b408fe10be20a8cc29b3f972287ff948674c881d
SSDEEP

12288:ciHw0sbzwD4FwpH5qCwfwM+A5n5RwUwjwEQwJw+wXcdwnTwuwJwxewGw90wHwMwd:cVi

Score

10^/10

icedid 612758225 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

612758225

C2

pildofraften.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2764 rundll32.exe
2764 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hey\superstring.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2764-0-0x0000020B27DA0000-0x0000020B27DA6000-memory.dmp

Filesize
24KB

Download
memory/2764-1-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download