icedid | 33ee572238490c5fb2b183ebcbeeb67602dd1578aa2b8a4d189a735adc82d101 | Triage™

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 19:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rockstar.exe
Size 372KB
Sample201109-4cs67dnxhe
SHA256 33ee572238490c5fb2b183ebcbeeb67602dd1578aa2b8a4d189a735adc82d101
MD5 9ceacf7c8d2afe6133a640fb0f698fac
SHA1 457f6bb5067c899f15ff93eead4efa950e6f6456
SHA512 4a120d9b91402604393ff99016b6e3ebfa5594a24c72f87f96d9be783a316cf4632ecd267343ef3b430619398437de121ea3180c92ac38c53eb28b82e10abc5d
MD5 SHA1 SHA512

Score

10^/10

icedid banker loader trojan

Malware Config

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral1/memory/1664-0-0x00000000002E0000-0x00000000002E6000-memory.dmp	IcedidFirstLoader

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1664	rockstar.exe
1664	rockstar.exe

C:\Users\Admin\AppData\Local\Temp\rockstar.exe
"C:\Users\Admin\AppData\Local\Temp\rockstar.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1664-0-0x00000000002E0000-0x00000000002E6000-memory.dmp

Download