Analysis
-
max time kernel
169s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
30-05-2022 21:27
General
-
Target
08966fc06c2e26f4dbb36f50812afd3863aa7ae04463bc931506a97a8d866cd5.exe
-
Size
220KB
-
MD5
1a7c450bdcfe99da1427d976de6d7246
-
SHA1
ddd5895e7837abfed13e28630e21884901966f4f
-
SHA256
08966fc06c2e26f4dbb36f50812afd3863aa7ae04463bc931506a97a8d866cd5
-
SHA512
0403918e746f9906e91a90bc3442649666ef49ac559d53daca6b25a50ca067d20926dd5a3f7f097a91df3b6db07396d011bbe41f3a3deb3a2010ce2f9e82fa37
Score
10/10
Malware Config
Extracted
Family
icedid
Botnet
513366864
C2
gfthwards.com
gfthwards.eu
gfthwards.net
presifered.com
Attributes
-
auth_var
8
-
url_path
/index.php
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
IcedID Second Stage Loader 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\08966fc06c2e26f4dbb36f50812afd3863aa7ae04463bc931506a97a8d866cd5.exe"C:\Users\Admin\AppData\Local\Temp\08966fc06c2e26f4dbb36f50812afd3863aa7ae04463bc931506a97a8d866cd5.exe"1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
20KB
-
Filesize
12KB