icedid | 77c7f07678e229fa33bbe7d1b6b3860016e39f50e867025cf4516686ff879015 | Triage

Analysis

max time kernel
147s
max time network
147s
platform
windows10_x64
resource
win10v20201028
submitted
13-11-2020 15:12

Sharing

Report Analysis Logs

General

Target

77c7f07678e229fa33bbe7d1b6b3860016e39f50e867025cf4516686ff879015.exe
Size

636KB
MD5

1395c03d409320d2b2ccfe69eccb97ab
SHA1

ad08f90b277be61c66f53683305435b98f64f177
SHA256

77c7f07678e229fa33bbe7d1b6b3860016e39f50e867025cf4516686ff879015
SHA512

783e01f979d8675d00cc7a50e91d4dcf66a5df8c14c8d1cdee70afc9b8b18d8c692cf224ae346b617fa7795d42764496813e2b2c1b06d0161da975bcebb548b9

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

kostacardsplayer.pro

kostafootball.info

countrylandlords.info

landiscloudlord.red

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3160-0-0x0000000000560000-0x0000000000565000-memory.dmp	IcedidSecondLoader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

77c7f07678e229fa33bbe7d1b6b3860016e39f50e867025cf4516686ff879015.exe

pid process

3160 77c7f07678e229fa33bbe7d1b6b3860016e39f50e867025cf4516686ff879015.exe

C:\Users\Admin\AppData\Local\Temp\77c7f07678e229fa33bbe7d1b6b3860016e39f50e867025cf4516686ff879015.exe
"C:\Users\Admin\AppData\Local\Temp\77c7f07678e229fa33bbe7d1b6b3860016e39f50e867025cf4516686ff879015.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3160-0-0x0000000000560000-0x0000000000565000-memory.dmp

Filesize
20KB

Download