Resubmissions
19-08-2024 05:25
240819-f4rpbawfne 10Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
19-08-2024 05:25
General
-
Target
6302f08805736a80b939c7b4e226bc7c0201c8ea567f0aaa5ac058c87c6c829f_cadb54c7e091da0edba5869737fa1625013.dll
-
Size
673KB
-
MD5
f13677c7f6ba484dddf7c5a5bc4739de
-
SHA1
9c1766092238a591f3600bdf249ab2f7eb5f6c85
-
SHA256
cadb54c7e091da0edba5869737fa16250131b0ffe3bb50394e51d26db1aa36a6
-
SHA512
bd97b7909fd431496f694f7941334603bac7988ffabb2082f4974e53116a66e7ccfaf634b69865ac0446ec87139e3ffc49aeb6d1ed0c30718fa251814f81e2d5
-
SSDEEP
12288:xozmUG1wwQS2ijcSBC6nTSYkFzGC9055EnY/WAlibW4pBMLbN9vbu42oGHvAPIdb:xZUkQ5CTSYkFX9o5EnWllibZpBMvN5bY
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
1060798742
C2
carismorth.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
Blocklisted process makes network request 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6302f08805736a80b939c7b4e226bc7c0201c8ea567f0aaa5ac058c87c6c829f_cadb54c7e091da0edba5869737fa1625013.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB