icedid | 63692f8532a6b1c1e78c51d96842e7c90a841a9afe76c9d71beb2ca5bfc0bfa5

Analysis

Target

abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503.exe
Size

240KB
MD5

3fbcd911c5616182a5ced7f40fdfa28f
SHA1

690e6e312df91174f1d13dce26c48abab7d74c96
SHA256

abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503
SHA512

7dfd43197a4dc3770fb09d8979c3edb394cff72e0c4854ca1a2f98c05ae00e85854469c66327eb71facbf0099bec1a8880e041105c2ab455c0d1aec2541b1d0a

Score

10^/10

Family

icedid

kodjakskoda.club

financesromma.club

slobrewelo.pw

nifrittilo.pw

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 3 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/1100-61-0x0000000000350000-0x0000000000358000-memory.dmp	IcedidSecondLoader
behavioral1/memory/1100-64-0x0000000000360000-0x0000000000366000-memory.dmp	IcedidSecondLoader
behavioral1/memory/1100-67-0x0000000000340000-0x0000000000345000-memory.dmp	IcedidSecondLoader

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503.exe

pid	process
1100	abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503.exe
1100	abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503.exe

C:\Users\Admin\AppData\Local\Temp\abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503.exe
"C:\Users\Admin\AppData\Local\Temp\abe866ba9e8a9956a64ef4bc48ace783daa30d51b86fa60adfbb6d8fa044c503.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1100

memory/1100-60-0x0000000075C71000-0x0000000075C73000-memory.dmp

Filesize
8KB

Download
memory/1100-61-0x0000000000350000-0x0000000000358000-memory.dmp

Filesize
32KB

Download
memory/1100-64-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1100-66-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1100-67-0x0000000000340000-0x0000000000345000-memory.dmp

Filesize
20KB

Download