icedid | 4246e70742be86fe87595703f7e3108f7c59eb71665435ecebeb7316775b9faa | Triage

Analysis

max time kernel
147s
max time network
147s
platform
windows10_x64
resource
win10v20201028
submitted
13-11-2020 15:32

Sharing

Report Analysis Logs

General

Target

4246e70742be86fe87595703f7e3108f7c59eb71665435ecebeb7316775b9faa.exe
Size

778KB
MD5

b15706ca4ffcdc3685777dde75448c24
SHA1

db867a6c8ac0e5c7e57c12cb17514b021cab25c4
SHA256

4246e70742be86fe87595703f7e3108f7c59eb71665435ecebeb7316775b9faa
SHA512

322652b5e97fb62bdc8eb144c8cb18f67cebb5b598d7ea4534db415817e54990d1afb4889297d0f573b6796678de08a2c6532ce4ccc33e75f36dc13c09e84f14

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

kostacardsplayer.pro

kostafootball.info

countrylandlords.info

landiscloudlord.red

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3980-0-0x0000000000A20000-0x0000000000A25000-memory.dmp	IcedidSecondLoader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4246e70742be86fe87595703f7e3108f7c59eb71665435ecebeb7316775b9faa.exe

pid process

3980 4246e70742be86fe87595703f7e3108f7c59eb71665435ecebeb7316775b9faa.exe

C:\Users\Admin\AppData\Local\Temp\4246e70742be86fe87595703f7e3108f7c59eb71665435ecebeb7316775b9faa.exe
"C:\Users\Admin\AppData\Local\Temp\4246e70742be86fe87595703f7e3108f7c59eb71665435ecebeb7316775b9faa.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3980-0-0x0000000000A20000-0x0000000000A25000-memory.dmp

Filesize
20KB

Download