icedid | 0131026051228584a83997be64c30e7c9cd90c1657d9fffb11d427f577f4a134

Analysis

Target

0131026051228584a83997be64c30e7c9cd90c1657d9fffb11d427f577f4a134.exe
Size

84KB
MD5

e518b053633f83917af43c3c6f81c141
SHA1

4c85a76114f2886f2c873c212f88320e4715ba93
SHA256

0131026051228584a83997be64c30e7c9cd90c1657d9fffb11d427f577f4a134
SHA512

dbc2b62f2f2e8ca09b042e21516810cf0f34ef722a651b9661bef3ac5497cad8b87c5eff90a16190e3b44848100ecf0d14edc872afb38efdd27db0d7626da836

Score

10^/10

Family

icedid

vergilliostar.top

mentokiller.top

ekxortsisto.best

netutto.best

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/2004-55-0x00000000003F0000-0x00000000003F3000-memory.dmp	IcedidSecondLoader
behavioral1/memory/2004-56-0x0000000001C30000-0x0000000001C36000-memory.dmp	IcedidSecondLoader

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

0131026051228584a83997be64c30e7c9cd90c1657d9fffb11d427f577f4a134.exe

pid	process
2004	0131026051228584a83997be64c30e7c9cd90c1657d9fffb11d427f577f4a134.exe
2004	0131026051228584a83997be64c30e7c9cd90c1657d9fffb11d427f577f4a134.exe

C:\Users\Admin\AppData\Local\Temp\0131026051228584a83997be64c30e7c9cd90c1657d9fffb11d427f577f4a134.exe
"C:\Users\Admin\AppData\Local\Temp\0131026051228584a83997be64c30e7c9cd90c1657d9fffb11d427f577f4a134.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2004

memory/2004-54-0x0000000076191000-0x0000000076193000-memory.dmp

Filesize
8KB

Download
memory/2004-55-0x00000000003F0000-0x00000000003F3000-memory.dmp

Filesize
12KB

Download
memory/2004-56-0x0000000001C30000-0x0000000001C36000-memory.dmp

Filesize
24KB

Download