icedid | d5c6b3b0a05c14b7b4a403e2b5d4afcefbe0bea7f015bc36294b11d453c9087d | Triage

Analysis

max time kernel
147s
max time network
148s
platform
windows10_x64
resource
win10v20201028
submitted
13-11-2020 15:58

Sharing

Report Analysis Logs

General

Target

d5c6b3b0a05c14b7b4a403e2b5d4afcefbe0bea7f015bc36294b11d453c9087d.exe
Size

793KB
MD5

3759db33c71b446ed5ea367561fc066c
SHA1

f3bb9bd7f9b99b73d074bb87e34b9f7bcfbe8d41
SHA256

d5c6b3b0a05c14b7b4a403e2b5d4afcefbe0bea7f015bc36294b11d453c9087d
SHA512

57fd07839da885aa990fb1a120d457ad37ab9011cbfcb43a09b8fbfa83961ac904a3f0435edb22f704bee3b8adb90b52fe305769b00347ce6a39c93e4cb1cf07

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

kostacardsplayer.pro

kostafootball.info

countrylandlords.info

landiscloudlord.red

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3408-0-0x0000000000BC0000-0x0000000000BC5000-memory.dmp	IcedidSecondLoader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

d5c6b3b0a05c14b7b4a403e2b5d4afcefbe0bea7f015bc36294b11d453c9087d.exe

pid process

3408 d5c6b3b0a05c14b7b4a403e2b5d4afcefbe0bea7f015bc36294b11d453c9087d.exe

C:\Users\Admin\AppData\Local\Temp\d5c6b3b0a05c14b7b4a403e2b5d4afcefbe0bea7f015bc36294b11d453c9087d.exe
"C:\Users\Admin\AppData\Local\Temp\d5c6b3b0a05c14b7b4a403e2b5d4afcefbe0bea7f015bc36294b11d453c9087d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3408-0-0x0000000000BC0000-0x0000000000BC5000-memory.dmp

Filesize
20KB

Download