icedid | 63692f8532a6b1c1e78c51d96842e7c90a841a9afe76c9d71beb2ca5bfc0bfa5

Analysis

Target

abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503.exe
Size

240KB
MD5

3fbcd911c5616182a5ced7f40fdfa28f
SHA1

690e6e312df91174f1d13dce26c48abab7d74c96
SHA256

abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503
SHA512

7dfd43197a4dc3770fb09d8979c3edb394cff72e0c4854ca1a2f98c05ae00e85854469c66327eb71facbf0099bec1a8880e041105c2ab455c0d1aec2541b1d0a

Score

10^/10

Family

icedid

kodjakskoda.club

financesromma.club

slobrewelo.pw

nifrittilo.pw

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 3 IoCs

loader

Processes:

resource	yara_rule
behavioral2/memory/900-114-0x00000000021C0000-0x00000000021C8000-memory.dmp	IcedidSecondLoader
behavioral2/memory/900-117-0x00000000022E0000-0x00000000022E6000-memory.dmp	IcedidSecondLoader
behavioral2/memory/900-120-0x00000000021B0000-0x00000000021B5000-memory.dmp	IcedidSecondLoader

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503.exe

pid	process
900	abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503.exe
900	abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503.exe

C:\Users\Admin\AppData\Local\Temp\abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503.exe
"C:\Users\Admin\AppData\Local\Temp\abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:900

memory/900-114-0x00000000021C0000-0x00000000021C8000-memory.dmp

Filesize
32KB

Download
memory/900-117-0x00000000022E0000-0x00000000022E6000-memory.dmp

Filesize
24KB

Download
memory/900-119-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/900-120-0x00000000021B0000-0x00000000021B5000-memory.dmp

Filesize
20KB

Download