Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
26-10-2024 12:24
General
-
Target
a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58.dll
-
Size
15KB
-
MD5
06cc2fdfd408c15a1e16adfb46e8bb38
-
SHA1
585cfc19bdb8dfb92407e917615be1ab9dd523e5
-
SHA256
a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58
-
SHA512
eb11a4b40eb20610f3296af8c8a7c8af5934e10922146fdc524b8212077025ccd22aa69e16aa38af56a86bd49aedc9a36a00a3cb7de3368b194fe9026ebb18d4
-
SSDEEP
192:6P+nM5KC/zxayGc3gzq7YjDaqzJCueT+RfbZne9s6PLRP0tkYGijY5:s5Jxayczq7Yjt9lfle9s6PL16kYGi85
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
4165079571
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
Icedid family
-
Blocklisted process makes network request 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses