icedid | 3744195b84086ee6f4a00f33d75ebaa32c7d8bfad93934735abc862fe4d19a9b | Triage™

Analysis

max time kernel
147s
max time network
145s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 19:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.W32.Kryptik.HDAZtr.26938.exe
Size 168KB
Sample201109-snspbnd2ms
SHA256 3744195b84086ee6f4a00f33d75ebaa32c7d8bfad93934735abc862fe4d19a9b
MD5 e718be4beab1c300319f9c243b2f27df
SHA1 0c8f44ce2394b2d2386990f75265cfd63ea73305
SHA512 3864c767cd00431a010226bd42a351fac84e83aa6c5a8152044d79a4a43e3f094534e7d03199ecbe0755f94816fb20821bf8a854942ae611bc96f964d55cf912
MD5 SHA1 SHA512

Score

10^/10

icedid banker loader trojan

Malware Config

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral1/memory/1808-0-0x0000000000330000-0x0000000000336000-memory.dmp	IcedidFirstLoader

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1808	SecuriteInfo.com.W32.Kryptik.HDAZtr.26938.exe
1808	SecuriteInfo.com.W32.Kryptik.HDAZtr.26938.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Kryptik.HDAZtr.26938.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Kryptik.HDAZtr.26938.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-0-0x0000000000330000-0x0000000000336000-memory.dmp

Download