icedid | fed94556d81622a39c4bfbaf39fa11dcab6a9b63fc487e037ccb1771f92ea894 | Triage

Analysis

max time kernel
129s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-03-2024 21:00

Sharing

Report Analysis Logs

General

Target

hey/superstring.dll
Size

728KB
MD5

293b6dc3360e7be05e35e28cc4201e47
SHA1

7d2877e3eedd5b8d366b2fe44a117a9111c3d30a
SHA256

645e011080488d4f5c14d217f5571372e7939c50a3568021cf9d434cf6f5f439
SHA512

fb9222361b530d8a279a8e1a6342b3f71f4de9674e1f904608a86e43b6641e07a8afcfd77df0ec4c7d8f4801b408fe10be20a8cc29b3f972287ff948674c881d
SSDEEP

12288:ciHw0sbzwD4FwpH5qCwfwM+A5n5RwUwjwEQwJw+wXcdwnTwuwJwxewGw90wHwMwd:cVi

Score

10^/10

icedid 612758225 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

612758225

C2

pildofraften.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1340 rundll32.exe
1340 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hey\superstring.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-0-0x0000016FF94D0000-0x0000016FF94D6000-memory.dmp

Filesize
24KB

Download
memory/1340-1-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download