icedid | b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b | Triage

Analysis

max time kernel
213s
max time network
228s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20-05-2022 22:43

Sharing

Report Analysis Logs

General

Target

b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b.exe
Size

382KB
MD5

0ef3890b051c62c04435a5ab8cb15ec2
SHA1

c810007de17fe76f2fca134d0a1003c790a616d9
SHA256

b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b
SHA512

e56f43ae5a2c19f1e5b74ab5018821257aac3a5d94daa2c656d6181d33250acfed04f48d7bd678ab946d7eb48204760cb488a24f3503919b13ea7438bd1f2bc0

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

wloppyload.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2320-130-0x00000000022E0000-0x00000000022E3000-memory.dmp	IcedidFirstLoader
behavioral2/memory/2320-131-0x0000000002310000-0x0000000002316000-memory.dmp	IcedidFirstLoader

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b.exe

pid	process
2320	b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b.exe
2320	b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b.exe

C:\Users\Admin\AppData\Local\Temp\b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b.exe
"C:\Users\Admin\AppData\Local\Temp\b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2320-130-0x00000000022E0000-0x00000000022E3000-memory.dmp

Filesize
12KB

Download
memory/2320-131-0x0000000002310000-0x0000000002316000-memory.dmp

Filesize
24KB

Download