icedid | 894bf073a8ca2212e44e5d9a3c6cd38d7e7a974c94e5be9d528c4fb490def0ad | Triage

Analysis

max time kernel
146s
max time network
149s
platform
windows10_x64
resource
win10v20201028
submitted
13-11-2020 15:15

Sharing

Report Analysis Logs

General

Target

894bf073a8ca2212e44e5d9a3c6cd38d7e7a974c94e5be9d528c4fb490def0ad.exe
Size

701KB
MD5

a49a8d3d1098dfb6e1dc59007ab5082b
SHA1

300eaad0b4a7e042146912416d76db7436a622c0
SHA256

894bf073a8ca2212e44e5d9a3c6cd38d7e7a974c94e5be9d528c4fb490def0ad
SHA512

6bec26bfcf2bdbd2d4aaee8995972495116a82dd6f0dad94b455895fda8050d9ce899f347b7a2b234255762f472efbf4bc5b0ec2d8d98853a9ee0367a81827ec

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

kostacardsplayer.pro

kostafootball.info

countrylandlords.info

landiscloudlord.red

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3980-0-0x0000000000A20000-0x0000000000A25000-memory.dmp	IcedidSecondLoader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

894bf073a8ca2212e44e5d9a3c6cd38d7e7a974c94e5be9d528c4fb490def0ad.exe

pid process

3980 894bf073a8ca2212e44e5d9a3c6cd38d7e7a974c94e5be9d528c4fb490def0ad.exe

C:\Users\Admin\AppData\Local\Temp\894bf073a8ca2212e44e5d9a3c6cd38d7e7a974c94e5be9d528c4fb490def0ad.exe
"C:\Users\Admin\AppData\Local\Temp\894bf073a8ca2212e44e5d9a3c6cd38d7e7a974c94e5be9d528c4fb490def0ad.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3980-0-0x0000000000A20000-0x0000000000A25000-memory.dmp

Filesize
20KB

Download