icedid | e40ec3122fbfe0361dbdc41a7d36bc2684b26ad1b3e6a0d76fbacc5032005157 | Triage

Analysis

max time kernel
149s
max time network
126s
platform
windows7_x64
resource
win7v20201028
submitted
13-11-2020 16:09

Sharing

Report Analysis Logs

General

Target

e40ec3122fbfe0361dbdc41a7d36bc2684b26ad1b3e6a0d76fbacc5032005157.exe
Size

672KB
MD5

1f12b7ea6fc90fd4ebba7f51925a219d
SHA1

78980cea068260c0a7423bf0a377f112b518a9aa
SHA256

e40ec3122fbfe0361dbdc41a7d36bc2684b26ad1b3e6a0d76fbacc5032005157
SHA512

d588d30a82a77ce0e404a4907f74420931c2f46bf6bf0fa0ad011466e6123a8742d3d00121c02244627f66919ad60d0cff0eaf9156421c7c8f363cce00b21613

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

kostacardsplayer.pro

kostafootball.info

countrylandlords.info

landiscloudlord.red

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/536-0-0x0000000000360000-0x0000000000365000-memory.dmp	IcedidSecondLoader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

e40ec3122fbfe0361dbdc41a7d36bc2684b26ad1b3e6a0d76fbacc5032005157.exe

pid process

536 e40ec3122fbfe0361dbdc41a7d36bc2684b26ad1b3e6a0d76fbacc5032005157.exe

C:\Users\Admin\AppData\Local\Temp\e40ec3122fbfe0361dbdc41a7d36bc2684b26ad1b3e6a0d76fbacc5032005157.exe
"C:\Users\Admin\AppData\Local\Temp\e40ec3122fbfe0361dbdc41a7d36bc2684b26ad1b3e6a0d76fbacc5032005157.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-0-0x0000000000360000-0x0000000000365000-memory.dmp

Filesize
20KB

Download