icedid | fed94556d81622a39c4bfbaf39fa11dcab6a9b63fc487e037ccb1771f92ea894 | Triage

Analysis

max time kernel
129s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-03-2024 21:00

Sharing

Report Analysis Logs

General

Target

hey/superstring.dll
Size

728KB
MD5

293b6dc3360e7be05e35e28cc4201e47
SHA1

7d2877e3eedd5b8d366b2fe44a117a9111c3d30a
SHA256

645e011080488d4f5c14d217f5571372e7939c50a3568021cf9d434cf6f5f439
SHA512

fb9222361b530d8a279a8e1a6342b3f71f4de9674e1f904608a86e43b6641e07a8afcfd77df0ec4c7d8f4801b408fe10be20a8cc29b3f972287ff948674c881d
SSDEEP

12288:ciHw0sbzwD4FwpH5qCwfwM+A5n5RwUwjwEQwJw+wXcdwnTwuwJwxewGw90wHwMwd:cVi

Score

10^/10

icedid 612758225 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

612758225

C2

pildofraften.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2748 rundll32.exe
2748 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hey\superstring.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2748-0-0x0000000000110000-0x0000000000116000-memory.dmp

Filesize
24KB

Download
memory/2748-1-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download