Overview

overview

10

Static

static

f8f351415e...1e.exe

windows7_x64

10

f8f351415e...1e.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    182s
  • max time network
    206s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    08/05/2022, 01:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    f8f351415ee7c63613aede4a8b4642c2afa432396ef5f949a1b8e6a58210f41e.exe
  • Size 238KB
  • Sample220508-bfbkzaahf3
  • SHA256 f8f351415ee7c63613aede4a8b4642c2afa432396ef5f949a1b8e6a58210f41e
  • MD5 SHA1 SHA512
Score
10/10
icedid2635507097bankerloadertrojan

Malware Config

Extracted

Family

  • icedid

Extracted

Family

  • icedid

Botnet

  • 2635507097

C2

  • rufepuksuka.cyou

  • uzhokpidarok.cyou

Attributes
  • auth_var

    1

  • url_path

    /audio/

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • IcedID Second Stage Loader 2 IoCs
    loader

Processes

  • C:\Users\Admin\AppData\Local\Temp\f8f351415ee7c63613aede4a8b4642c2afa432396ef5f949a1b8e6a58210f41e.exe
    "C:\Users\Admin\AppData\Local\Temp\f8f351415ee7c63613aede4a8b4642c2afa432396ef5f949a1b8e6a58210f41e.exe"
    1⤵
      PID:364

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/364-130-0x0000000000CC0000-0x0000000000DFC000-memory.dmp
          Download

          memory/364-131-0x0000000000CC0000-0x0000000000CC6000-memory.dmp
          Download