Overview

overview

10

Static

static

2.exe

windows7_x64

10

2.exe

windows10_x64

10

Resubmissions

09-12-2021 17:57

211209-wj1dqaeedq 10

06-12-2021 09:45

211206-lrasxsgeh3 3

22-11-2021 13:35

211122-qvrytsfehq 3

Analysis

  • max time kernel
    110s
  • max time network
    139s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    09-12-2021 17:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2.exe

  • Size

    177KB

  • MD5

    20478d2d2b86e6c8c9da84af39fd652b

  • SHA1

    f9c926efee370218d0d82dd75e703f46355e6018

  • SHA256

    33fd2f2b2053150f21129807c381d38874c7622d207a8d036782db82cc61455b

  • SHA512

    a348e4d5245b6aff3242f02f66415874a6380fa26740ed18ff2e995a87a386acc2e93182066abc3d6e7dc253909ed79099db70209ca38f779adb7fe67c78b613

Score
10/10
icedid862604275bankersuricatatrojan

Malware Config

Extracted

Family

icedid

Campaign

862604275

C2

nchestothe.ink

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2.exe
    "C:\Users\Admin\AppData\Local\Temp\2.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2060-115-0x00007FF75F6B0000-0x00007FF75F6B9000-memory.dmp
    Filesize

    36KB

    Download