icedid | 7d11a323dede4ffda3f80c766f89696fc8b825d2691e0d2e7482906688cb03b9 | Triage

Analysis

max time kernel
151s
max time network
171s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-06-2022 07:26

Sharing

Report Analysis Logs

General

Target

7d11a323dede4ffda3f80c766f89696fc8b825d2691e0d2e7482906688cb03b9.exe
Size

136KB
MD5

35a987fa7f93e6cc2065eb2f3fc11f9c
SHA1

9122e2dcc49027e321383f87a80811b6e8f566a3
SHA256

7d11a323dede4ffda3f80c766f89696fc8b825d2691e0d2e7482906688cb03b9
SHA512

3f7b395b6e978d3a171010935b68160ce8eb4c72ece1c82250068535551b27daa1390bb9fff8d37aadee09a0779f035feec0198201cf9ce1b635d1a7b9be34f8

Score

10^/10

icedid 407810942 banker loader trojan

Malware Config

Extracted

Family

icedid

Botnet

407810942

C2

laroshelle.best

appleparkca.best

bigbonmax.best

applethecompany.best

bulbulmeni.best

Attributes

auth_var
8
url_path
/index.php

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1648-55-0x0000000000250000-0x0000000000255000-memory.dmp	IcedidSecondLoader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

7d11a323dede4ffda3f80c766f89696fc8b825d2691e0d2e7482906688cb03b9.exe

pid process

1648 7d11a323dede4ffda3f80c766f89696fc8b825d2691e0d2e7482906688cb03b9.exe

C:\Users\Admin\AppData\Local\Temp\7d11a323dede4ffda3f80c766f89696fc8b825d2691e0d2e7482906688cb03b9.exe
"C:\Users\Admin\AppData\Local\Temp\7d11a323dede4ffda3f80c766f89696fc8b825d2691e0d2e7482906688cb03b9.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/1648-55-0x0000000000250000-0x0000000000255000-memory.dmp

Filesize
20KB

Download