Overview

overview

10

Static

static

86747b573f...16.exe

windows7_x64

10

86747b573f...16.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    199s
  • max time network
    68s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    12-05-2022 12:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    86747b573f7f2f20d75754e073411b56e93515eba22cf5c4307a24059e662b16.exe

  • Size

    228KB

  • MD5

    dd11fb3c9d76df104dd54cab9eabc403

  • SHA1

    63f7f1b2281f82bec711ab3dc490abde5a24f288

  • SHA256

    86747b573f7f2f20d75754e073411b56e93515eba22cf5c4307a24059e662b16

  • SHA512

    1532121e4d03955f5a4c33bd622a5da09357b37448ea923dacf12ca98e77af822de1dc3af3cd773f23d175c9b1cf5c42e914b01dbd150528d62e46b738f01949

Score
10/10
icedid3940132575bankerloadertrojan

Malware Config

Extracted

Family

icedid

Extracted

Family

icedid

Botnet

3940132575

C2

besitxavier.best

nazifestivo.best
Attributes
  • auth_var

    2

  • url_path

    /audio/

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • IcedID Second Stage Loader 3 IoCs
    loader
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\86747b573f7f2f20d75754e073411b56e93515eba22cf5c4307a24059e662b16.exe
    "C:\Users\Admin\AppData\Local\Temp\86747b573f7f2f20d75754e073411b56e93515eba22cf5c4307a24059e662b16.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1432-54-0x0000000076461000-0x0000000076463000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1432-55-0x0000000000290000-0x0000000000298000-memory.dmp
    Filesize

    32KB

    Download
  • memory/1432-59-0x00000000003B0000-0x00000000003B6000-memory.dmp
    Filesize

    24KB

    Download
  • memory/1432-63-0x0000000000270000-0x0000000000275000-memory.dmp
    Filesize

    20KB

    Download