icedid | 606bcd4c30f22a2328a273538ab06aa033c6bfac32e95d73b9a9c5bfd39d2ebe

Analysis

Target

606bcd4c30f22a2328a273538ab06aa033c6bfac32e95d73b9a9c5bfd39d2ebe.exe
Size

340KB
MD5

12c51d4a870f350f6337b5ca7a8ad6b3
SHA1

0cbe6d48fc2ff7a97778dce3084b784466961570
SHA256

606bcd4c30f22a2328a273538ab06aa033c6bfac32e95d73b9a9c5bfd39d2ebe
SHA512

3f2d125dabcf2d13358178f56cae2882c1409212e404c1e99f30d720bcb0ed7c46a4ae2bf0f0a57eb43c49a8bf4a48f39e28c9ae3cac241baed2801e83c93eb7

Score

10^/10

Family

icedid

middleposition.cyou

artsteerlingwheel.top

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 1 IoCs

loader

Processes:

resource	yara_rule
behavioral2/memory/2560-146-0x0000000002120000-0x0000000002126000-memory.dmp	IcedidSecondLoader

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

606bcd4c30f22a2328a273538ab06aa033c6bfac32e95d73b9a9c5bfd39d2ebe.exe

pid	process
2560	606bcd4c30f22a2328a273538ab06aa033c6bfac32e95d73b9a9c5bfd39d2ebe.exe
2560	606bcd4c30f22a2328a273538ab06aa033c6bfac32e95d73b9a9c5bfd39d2ebe.exe

C:\Users\Admin\AppData\Local\Temp\606bcd4c30f22a2328a273538ab06aa033c6bfac32e95d73b9a9c5bfd39d2ebe.exe
"C:\Users\Admin\AppData\Local\Temp\606bcd4c30f22a2328a273538ab06aa033c6bfac32e95d73b9a9c5bfd39d2ebe.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2560

memory/2560-134-0x0000000002110000-0x0000000002112000-memory.dmp

Filesize
8KB

Download
memory/2560-133-0x0000000002110000-0x0000000002112000-memory.dmp

Filesize
8KB

Download
memory/2560-135-0x0000000002110000-0x0000000002112000-memory.dmp

Filesize
8KB

Download
memory/2560-136-0x0000000002110000-0x0000000002112000-memory.dmp

Filesize
8KB

Download
memory/2560-138-0x0000000002110000-0x0000000002112000-memory.dmp

Filesize
8KB

Download
memory/2560-137-0x0000000002110000-0x0000000002112000-memory.dmp

Filesize
8KB

Download
memory/2560-140-0x0000000002110000-0x0000000002112000-memory.dmp

Filesize
8KB

Download
memory/2560-139-0x0000000002110000-0x0000000002112000-memory.dmp

Filesize
8KB

Download
memory/2560-142-0x0000000002110000-0x0000000002112000-memory.dmp

Filesize
8KB

Download
memory/2560-145-0x0000000002110000-0x0000000002112000-memory.dmp

Filesize
8KB

Download
memory/2560-144-0x0000000002110000-0x0000000002112000-memory.dmp

Filesize
8KB

Download
memory/2560-143-0x0000000002110000-0x0000000002112000-memory.dmp

Filesize
8KB

Download
memory/2560-141-0x0000000002110000-0x0000000002112000-memory.dmp

Filesize
8KB

Download
memory/2560-146-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/2560-151-0x0000000002110000-0x0000000002112000-memory.dmp

Filesize
8KB

Download