Analysis
- max time kernel
147s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
10/03/2024, 02:32
General
- Target a6275383ffec22509908a083fa77d250ef4ccde0ef488dad7818d1eceb9e2998.dll
- Size 250KB
- Sample240310-c1rclaaa73
- SHA256 a6275383ffec22509908a083fa77d250ef4ccde0ef488dad7818d1eceb9e2998
Score
10/10
Malware Config
Extracted
Family
-
icedid
Signatures
- IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
- IcedID Second Stage Loader 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a6275383ffec22509908a083fa77d250ef4ccde0ef488dad7818d1eceb9e2998.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a6275383ffec22509908a083fa77d250ef4ccde0ef488dad7818d1eceb9e2998.dll,#12⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4420-0-0x0000000074BB0000-0x0000000074C05000-memory.dmp
memory/4420-1-0x0000000000D60000-0x0000000000D61000-memory.dmp
memory/4420-2-0x0000000074BB0000-0x0000000074C05000-memory.dmp
memory/4420-5-0x0000000000D60000-0x0000000000D61000-memory.dmp