Overview

overview

10

Static

static

2cdf066be8...7b.exe

windows7_x64

10

2cdf066be8...7b.exe

windows10_x64

10

Analysis

  • max time kernel
    10s
  • max time network
    113s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    26-07-2021 22:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2cdf066be8b5278ab728277cd77b8f3f5bc042a89e4e386b3202c8c6c4be737b.exe

  • Size

    56KB

  • MD5

    7e198bc723b2db4378fcf6bebfd8f434

  • SHA1

    c1c3d7f5b2af29f855ec0da721b2008a5f9ce8fe

  • SHA256

    2cdf066be8b5278ab728277cd77b8f3f5bc042a89e4e386b3202c8c6c4be737b

  • SHA512

    fd7e5951ad9564ab86facdac352c43f8f76bda79a2befa1be91d65fcaf238bd3073c94e86dedb4536b0da5b8980b0f222c3ada88644f8cc429d66bfac185db16

Score
10/10
icedidbankerloadertrojan

Malware Config

Extracted

Family

icedid

C2

bomberfiller.cyou

fekoliture.cyou

bomminollio.co

landingforced.co

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • IcedID Second Stage Loader 3 IoCs
    loader
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2cdf066be8b5278ab728277cd77b8f3f5bc042a89e4e386b3202c8c6c4be737b.exe
    "C:\Users\Admin\AppData\Local\Temp\2cdf066be8b5278ab728277cd77b8f3f5bc042a89e4e386b3202c8c6c4be737b.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3988-114-0x00000000022D0000-0x00000000022D8000-memory.dmp
    Filesize

    32KB

    Download
  • memory/3988-118-0x00000000022E0000-0x00000000022E6000-memory.dmp
    Filesize

    24KB

    Download
  • memory/3988-120-0x00000000022C0000-0x00000000022C5000-memory.dmp
    Filesize

    20KB

    Download
  • memory/3988-117-0x00000000022A0000-0x00000000022A1000-memory.dmp
    Filesize

    4KB

    Download