Overview

overview

10

Static

static

08966fc06c...d5.exe

windows7_x64

10

08966fc06c...d5.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    169s
  • max time network
    174s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    30-05-2022 21:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    08966fc06c2e26f4dbb36f50812afd3863aa7ae04463bc931506a97a8d866cd5.exe

  • Size

    220KB

  • MD5

    1a7c450bdcfe99da1427d976de6d7246

  • SHA1

    ddd5895e7837abfed13e28630e21884901966f4f

  • SHA256

    08966fc06c2e26f4dbb36f50812afd3863aa7ae04463bc931506a97a8d866cd5

  • SHA512

    0403918e746f9906e91a90bc3442649666ef49ac559d53daca6b25a50ca067d20926dd5a3f7f097a91df3b6db07396d011bbe41f3a3deb3a2010ce2f9e82fa37

Score
10/10
icedid513366864bankerloadertrojan

Malware Config

Extracted

Family

icedid

Botnet

513366864

C2

gfthwards.com

gfthwards.eu

gfthwards.net

presifered.com
Attributes
  • auth_var

    8

  • url_path

    /index.php

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • IcedID Second Stage Loader 1 IoCs
    loader
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08966fc06c2e26f4dbb36f50812afd3863aa7ae04463bc931506a97a8d866cd5.exe
    "C:\Users\Admin\AppData\Local\Temp\08966fc06c2e26f4dbb36f50812afd3863aa7ae04463bc931506a97a8d866cd5.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1912-134-0x0000000002CA0000-0x0000000002CA3000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1912-133-0x0000000002CA0000-0x0000000002CA3000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1912-137-0x0000000002CA0000-0x0000000002CA3000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1912-144-0x0000000002CA0000-0x0000000002CA3000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1912-145-0x0000000002CA0000-0x0000000002CA3000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1912-143-0x0000000002CA0000-0x0000000002CA3000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1912-142-0x0000000002CA0000-0x0000000002CA3000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1912-141-0x0000000002CA0000-0x0000000002CA3000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1912-140-0x0000000002CA0000-0x0000000002CA3000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1912-139-0x0000000002CA0000-0x0000000002CA3000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1912-138-0x0000000002CA0000-0x0000000002CA3000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1912-135-0x0000000002CA0000-0x0000000002CA3000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1912-136-0x0000000002CA0000-0x0000000002CA3000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1912-146-0x0000000002CB0000-0x0000000002CB5000-memory.dmp
    Filesize

    20KB

    Download
  • memory/1912-150-0x0000000002CA0000-0x0000000002CA3000-memory.dmp
    Filesize

    12KB

    Download