icedid | 54dae0ca3c0ebcb8c89f68b842c1e06785dccfd9b7f6d09c459f2b948d74f65c | Triage

Analysis

max time kernel
149s
max time network
16s
platform
windows7_x64
resource
win7v20201028
submitted
13-11-2020 15:48

Sharing

Report Analysis Logs

General

Target

54dae0ca3c0ebcb8c89f68b842c1e06785dccfd9b7f6d09c459f2b948d74f65c.exe
Size

705KB
MD5

49668766b03c3b590b951750d36fc41e
SHA1

360432acabc4ca39bb40d090d65cc4ea72adf86a
SHA256

54dae0ca3c0ebcb8c89f68b842c1e06785dccfd9b7f6d09c459f2b948d74f65c
SHA512

2095510b121eb1fcf35382aaddbec2db3bb674414ad629e7a42a6aa1a2a1c2c4157d92268ba46ae27e364ab9698cd21dd72f07ee27e8150561a507d0c924fefd

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

kostacardsplayer.pro

kostafootball.info

countrylandlords.info

landiscloudlord.red

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1664-0-0x0000000000250000-0x0000000000255000-memory.dmp	IcedidSecondLoader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

54dae0ca3c0ebcb8c89f68b842c1e06785dccfd9b7f6d09c459f2b948d74f65c.exe

pid process

1664 54dae0ca3c0ebcb8c89f68b842c1e06785dccfd9b7f6d09c459f2b948d74f65c.exe

C:\Users\Admin\AppData\Local\Temp\54dae0ca3c0ebcb8c89f68b842c1e06785dccfd9b7f6d09c459f2b948d74f65c.exe
"C:\Users\Admin\AppData\Local\Temp\54dae0ca3c0ebcb8c89f68b842c1e06785dccfd9b7f6d09c459f2b948d74f65c.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1664-0-0x0000000000250000-0x0000000000255000-memory.dmp

Filesize
20KB

Download