Overview

overview

10

Static

static

0195d25035...02.exe

windows7_x64

10

0195d25035...02.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    23-05-2022 18:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0195d25035f1b6742e30deea74e60dc5bc97bd0c1b8ee0cc851afc279ae46002.exe

  • Size

    336KB

  • MD5

    c4dc3b3625286c747351914db949dfbf

  • SHA1

    d8bfee2a9c3c515a1e8d6498d373b068e2f6625a

  • SHA256

    0195d25035f1b6742e30deea74e60dc5bc97bd0c1b8ee0cc851afc279ae46002

  • SHA512

    af8d7345fb208574bf08b9bbc01541a61d0d4130edee7cc32a9d01109d837368018e9d0e68d1a8a670736fdcd150fc5680fede116256b2a5447909ef85a1090d

Score
10/10
icedid513366864bankerloadertrojan

Malware Config

Extracted

Family

icedid

Botnet

513366864

C2

gfthwards.com

gfthwards.eu

gfthwards.net

presifered.com

coujtried.com
Attributes
  • auth_var

    10

  • url_path

    /index.php

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • IcedID Second Stage Loader 1 IoCs
    loader
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0195d25035f1b6742e30deea74e60dc5bc97bd0c1b8ee0cc851afc279ae46002.exe
    "C:\Users\Admin\AppData\Local\Temp\0195d25035f1b6742e30deea74e60dc5bc97bd0c1b8ee0cc851afc279ae46002.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1564-56-0x00000000002F0000-0x00000000002F7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1564-66-0x00000000002F0000-0x00000000002F7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1564-68-0x00000000002F0000-0x00000000002F7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1564-67-0x00000000002F0000-0x00000000002F7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1564-65-0x00000000002F0000-0x00000000002F7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1564-64-0x00000000002F0000-0x00000000002F7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1564-63-0x00000000002F0000-0x00000000002F7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1564-62-0x00000000002F0000-0x00000000002F7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1564-61-0x00000000002F0000-0x00000000002F7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1564-60-0x00000000002F0000-0x00000000002F7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1564-57-0x00000000002F0000-0x00000000002F7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1564-59-0x00000000002F0000-0x00000000002F7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1564-58-0x00000000002F0000-0x00000000002F7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1564-69-0x0000000075CD1000-0x0000000075CD3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1564-70-0x0000000000310000-0x0000000000315000-memory.dmp
    Filesize

    20KB

    Download
  • memory/1564-74-0x00000000002F0000-0x00000000002F7000-memory.dmp
    Filesize

    28KB

    Download