icedid | 3f62a206e4f4f7bcd083e0b34400e802c9d63fb6e8dd7518bb7f81d3b21d4095 | Triage

Analysis

max time kernel
123s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
14-03-2022 12:38

Sharing

Report Analysis Logs

General

Target

04506aa64e3dc042853173e6dde04019095c1c860dbe354427b585af2ef32a5f.exe
Size

398KB
MD5

fdc19209c75a6806635987f0afe70b6a
SHA1

38d3dc4282408fec814b1ea3a808ef26c03bdfcd
SHA256

04506aa64e3dc042853173e6dde04019095c1c860dbe354427b585af2ef32a5f
SHA512

8c101caf21364b5de3bc09652342da6719e5a1032e44b79cba39db0b57981816182da4db11214d9b52b654fa756b25c233d8e2757110f26ae0ed22e5eb83b95c

Score

10^/10

icedid 464168897 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

464168897

C2

eriumhasappar.club

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

04506aa64e3dc042853173e6dde04019095c1c860dbe354427b585af2ef32a5f.exe

pid	process
4704	04506aa64e3dc042853173e6dde04019095c1c860dbe354427b585af2ef32a5f.exe
4704	04506aa64e3dc042853173e6dde04019095c1c860dbe354427b585af2ef32a5f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

04506aa64e3dc042853173e6dde04019095c1c860dbe354427b585af2ef32a5f.exe

pid process

4704 04506aa64e3dc042853173e6dde04019095c1c860dbe354427b585af2ef32a5f.exe

C:\Users\Admin\AppData\Local\Temp\04506aa64e3dc042853173e6dde04019095c1c860dbe354427b585af2ef32a5f.exe
"C:\Users\Admin\AppData\Local\Temp\04506aa64e3dc042853173e6dde04019095c1c860dbe354427b585af2ef32a5f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4704-134-0x000001D899E80000-0x000001D899E89000-memory.dmp

Filesize
36KB

Download