icedid | 63692f8532a6b1c1e78c51d96842e7c90a841a9afe76c9d71beb2ca5bfc0bfa5

Analysis

Target

abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503.exe
Size

240KB
MD5

3fbcd911c5616182a5ced7f40fdfa28f
SHA1

690e6e312df91174f1d13dce26c48abab7d74c96
SHA256

abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503
SHA512

7dfd43197a4dc3770fb09d8979c3edb394cff72e0c4854ca1a2f98c05ae00e85854469c66327eb71facbf0099bec1a8880e041105c2ab455c0d1aec2541b1d0a

Score

10^/10

Family

icedid

kodjakskoda.club

financesromma.club

slobrewelo.pw

nifrittilo.pw

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 3 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/452-61-0x0000000000260000-0x0000000000268000-memory.dmp	IcedidSecondLoader
behavioral1/memory/452-64-0x0000000000270000-0x0000000000276000-memory.dmp	IcedidSecondLoader
behavioral1/memory/452-67-0x0000000000250000-0x0000000000255000-memory.dmp	IcedidSecondLoader

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503.exe

pid	process
452	abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503.exe
452	abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503.exe

C:\Users\Admin\AppData\Local\Temp\abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503.exe
"C:\Users\Admin\AppData\Local\Temp\abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:452

memory/452-60-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download
memory/452-61-0x0000000000260000-0x0000000000268000-memory.dmp

Filesize
32KB

Download
memory/452-64-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/452-67-0x0000000000250000-0x0000000000255000-memory.dmp

Filesize
20KB

Download
memory/452-66-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download