Resubmissions
04-04-2024 22:53
240404-2txy8scf2z 1004-04-2024 22:48
240404-2rkwwsce4t 304-04-2024 13:49
240404-q45laahe2y 10Analysis
-
max time kernel
240s -
max time network
242s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
04-04-2024 13:49
General
-
Target
icedid_loader.dll
-
Size
192KB
-
MD5
6779daf60f7aa4bc357b264f32ff6cde
-
SHA1
1c6e76af95f2a17b8e518965d62b3c9d7ecba6d5
-
SHA256
e1d2c95eda751901a4bdae7ba381b85f5d7965b05afe245b5cbaccce9ecfb0bc
-
SHA512
7829bf03bcf5b79703a1ba35ca9ba785e879ab6bfb141f00436d043986511819625194cadf0d516128075e10b8d94c845d31965048f0679fdd236a72f34c215f
-
SSDEEP
6144:oZU+Q0/Xns9tMYN1fPdqTBNPenpNgpiF69:oS+Q289tMq1oPenPgpiF69
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
4165079571
C2
podiumstrtss.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
This rule detects samples from the IcedID family unpacked in memory, identifying code reuse of new config decryption function. 1 IoCs
This rule detects samples from the IcedID family unpacked in memory, identifying code reuse of new config decryption function.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\icedid_loader.dll, vcab /k chokopai7231⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3024-1-0x0000000180000000-0x0000000180009000-memory.dmpFilesize
36KB
-
memory/3024-4-0x00007FFB1BB71000-0x00007FFB1BB72000-memory.dmpFilesize
4KB
-
memory/3024-9-0x00007FFB1BB71000-0x00007FFB1BB72000-memory.dmpFilesize
4KB
-
memory/4640-0-0x000001CD3FA40000-0x000001CD3FA44000-memory.dmpFilesize
16KB