icedid | 6bb9f0ee03144bf2c169895fcfbc131ee7cd739b3ccc1b60864263d2910a0ad0 | Triage™

Analysis

max time kernel
149s
max time network
149s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 19:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
[email protected]
Size 168KB
Sample201109-emb967mxbn
SHA256 6bb9f0ee03144bf2c169895fcfbc131ee7cd739b3ccc1b60864263d2910a0ad0
MD5 45953d833aafe2ada69ef5006672dab8
SHA1 ee0277a7d6b30d859e67960609b30ed2a34b0f61
SHA512 5ef07adae2fd28b47e0f3670c116e93f638e86f559074659407fdd8d155e0f791d8afd8fa88d3be0a0e46b1f0ba0be799c7012274bd67000c25f9794576c87f9
MD5 SHA1 SHA512

Score

10^/10

icedid banker loader trojan

Malware Config

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/3980-0-0x0000000002190000-0x0000000002196000-memory.dmp	IcedidFirstLoader

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3980	[email protected]
3980	[email protected]

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3980-0-0x0000000002190000-0x0000000002196000-memory.dmp

Download