icedid | a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58 | Triage

Analysis

max time kernel
14s
max time network
20s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2024 13:47

Sharing

Report Analysis Logs

General

Target

icedid.dll
Size

15KB
MD5

06cc2fdfd408c15a1e16adfb46e8bb38
SHA1

585cfc19bdb8dfb92407e917615be1ab9dd523e5
SHA256

a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58
SHA512

eb11a4b40eb20610f3296af8c8a7c8af5934e10922146fdc524b8212077025ccd22aa69e16aa38af56a86bd49aedc9a36a00a3cb7de3368b194fe9026ebb18d4
SSDEEP

192:6P+nM5KC/zxayGc3gzq7YjDaqzJCueT+RfbZne9s6PLRP0tkYGijY5:s5Jxayczq7Yjt9lfle9s6PL16kYGi85

Score

10^/10

icedid 4165079571 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

4165079571

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	3812	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3812	rundll32.exe
3812	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\icedid.dll, vcab /k chokopai723
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads