icedid | 7d11a323dede4ffda3f80c766f89696fc8b825d2691e0d2e7482906688cb03b9 | Triage

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
25-06-2022 07:26

Sharing

Report Analysis Logs

General

Target

7d11a323dede4ffda3f80c766f89696fc8b825d2691e0d2e7482906688cb03b9.exe
Size

136KB
MD5

35a987fa7f93e6cc2065eb2f3fc11f9c
SHA1

9122e2dcc49027e321383f87a80811b6e8f566a3
SHA256

7d11a323dede4ffda3f80c766f89696fc8b825d2691e0d2e7482906688cb03b9
SHA512

3f7b395b6e978d3a171010935b68160ce8eb4c72ece1c82250068535551b27daa1390bb9fff8d37aadee09a0779f035feec0198201cf9ce1b635d1a7b9be34f8

Score

10^/10

icedid 407810942 banker loader trojan

Malware Config

Extracted

Family

icedid

Botnet

407810942

C2

laroshelle.best

appleparkca.best

bigbonmax.best

applethecompany.best

bulbulmeni.best

Attributes

auth_var
8
url_path
/index.php

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3560-133-0x0000000000A10000-0x0000000000A15000-memory.dmp	IcedidSecondLoader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

7d11a323dede4ffda3f80c766f89696fc8b825d2691e0d2e7482906688cb03b9.exe

pid process

3560 7d11a323dede4ffda3f80c766f89696fc8b825d2691e0d2e7482906688cb03b9.exe

C:\Users\Admin\AppData\Local\Temp\7d11a323dede4ffda3f80c766f89696fc8b825d2691e0d2e7482906688cb03b9.exe
"C:\Users\Admin\AppData\Local\Temp\7d11a323dede4ffda3f80c766f89696fc8b825d2691e0d2e7482906688cb03b9.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3560-133-0x0000000000A10000-0x0000000000A15000-memory.dmp

Filesize
20KB

Download