icedid | c426b5f9a39e2e9d46c3074fc973e9d01fdfbf4f96870b624606e02233b08050

Analysis

Target

c426b5f9a39e2e9d46c3074fc973e9d01fdfbf4f96870b624606e02233b08050.exe
Size

228KB
MD5

e5eacbe6e8b732c14a651fe45e9924a4
SHA1

85e6e11c0a12a4bc3d7b5ba76791fa9eea4ea1ec
SHA256

c426b5f9a39e2e9d46c3074fc973e9d01fdfbf4f96870b624606e02233b08050
SHA512

d42fd09d58adec8528ddb1fd6243b55b74983f4ecc463bd02f4cdb6aaa5570d9de331e7c2b078055be92588fe30d17eeced62aafbf50e1b6683e0db663c25760

Score

10^/10

Family

icedid

Family

icedid

Botnet

3940132575

besitxavier.best

nazifestivo.best

Attributes

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 3 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/1976-55-0x0000000000390000-0x0000000000398000-memory.dmp	IcedidSecondLoader
behavioral1/memory/1976-59-0x00000000003A0000-0x00000000003A6000-memory.dmp	IcedidSecondLoader
behavioral1/memory/1976-63-0x0000000000380000-0x0000000000385000-memory.dmp	IcedidSecondLoader

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c426b5f9a39e2e9d46c3074fc973e9d01fdfbf4f96870b624606e02233b08050.exe

pid	process
1976	c426b5f9a39e2e9d46c3074fc973e9d01fdfbf4f96870b624606e02233b08050.exe
1976	c426b5f9a39e2e9d46c3074fc973e9d01fdfbf4f96870b624606e02233b08050.exe

C:\Users\Admin\AppData\Local\Temp\c426b5f9a39e2e9d46c3074fc973e9d01fdfbf4f96870b624606e02233b08050.exe
"C:\Users\Admin\AppData\Local\Temp\c426b5f9a39e2e9d46c3074fc973e9d01fdfbf4f96870b624606e02233b08050.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1976

memory/1976-54-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download
memory/1976-55-0x0000000000390000-0x0000000000398000-memory.dmp

Filesize
32KB

Download
memory/1976-59-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download
memory/1976-63-0x0000000000380000-0x0000000000385000-memory.dmp

Filesize
20KB

Download