icedid | e90adc56990de015caebe546eecd241ac3b1ad36a2495aa94c923bdd0bbb1d0a | Triage

Analysis

max time kernel
150s
max time network
66s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 21:35

Sharing

Report Analysis Logs

General

Target

e90adc56990de015caebe546eecd241ac3b1ad36a2495aa94c923bdd0bbb1d0a.exe
Size

781KB
MD5

aa0425f66889972c283344cc571b8927
SHA1

cdf991b2dc4770ddba13f07e5d478818dca61d40
SHA256

e90adc56990de015caebe546eecd241ac3b1ad36a2495aa94c923bdd0bbb1d0a
SHA512

6b4fccc07e8bdc53dca6f2df83f004e1f679aa501dd1ce0ad507662ba9f390a9cf42065ab00065909e241cfc039aacf0c1daebf2bcb2d116dc32bf5e9dfba55c

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

kostacardsplayer.pro

kostafootball.info

countrylandlords.info

landiscloudlord.red

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/300-0-0x0000000000250000-0x0000000000255000-memory.dmp	IcedidSecondLoader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

e90adc56990de015caebe546eecd241ac3b1ad36a2495aa94c923bdd0bbb1d0a.exe

pid process

300 e90adc56990de015caebe546eecd241ac3b1ad36a2495aa94c923bdd0bbb1d0a.exe

C:\Users\Admin\AppData\Local\Temp\e90adc56990de015caebe546eecd241ac3b1ad36a2495aa94c923bdd0bbb1d0a.exe
"C:\Users\Admin\AppData\Local\Temp\e90adc56990de015caebe546eecd241ac3b1ad36a2495aa94c923bdd0bbb1d0a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/300-0-0x0000000000250000-0x0000000000255000-memory.dmp

Filesize
20KB

Download