icedid | 0e7712f12b37469d64c5876a163891c15fdf94b2795522d61111003e71050e0f | Triage

Analysis

max time kernel
149s
max time network
15s
platform
windows7_x64
resource
win7v20201028
submitted
17-11-2020 12:22

Sharing

Report Analysis Logs

General

Target

2a6c086eed87e9665415439dd04fe1f1.exe
Size

739KB
MD5

c9707dbdcc6712fc191e49b80f5eb46e
SHA1

8e0128fa082d4e99e48ac1b1471c62381c2bb102
SHA256

0e7712f12b37469d64c5876a163891c15fdf94b2795522d61111003e71050e0f
SHA512

0f50052a7bf92a8993b9a2e9254f99db6c468d82adefde5acd9db7ea4f029ff5f40b3832031b90003129f4eb1c4144b66567c02f81698824cb977cc576f502f8

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

kostacardsplayer.pro

kostafootball.info

countrylandlords.info

landiscloudlord.red

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2036-0-0x0000000000260000-0x0000000000265000-memory.dmp	IcedidSecondLoader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

2a6c086eed87e9665415439dd04fe1f1.exe

pid process

2036 2a6c086eed87e9665415439dd04fe1f1.exe

C:\Users\Admin\AppData\Local\Temp\2a6c086eed87e9665415439dd04fe1f1.exe
"C:\Users\Admin\AppData\Local\Temp\2a6c086eed87e9665415439dd04fe1f1.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-0-0x0000000000260000-0x0000000000265000-memory.dmp

Filesize
20KB

Download