Analysis
-
max time kernel
182s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 03:29
General
-
Target
761114840822ac2ca103b8def7f30264034b0b783bed1127ba27ae5e13987d46.exe
-
Size
1.5MB
-
MD5
a44128ac144b7b03b9a18a1b3b81a3ab
-
SHA1
9d2afb0890ece493ddd68cd372d02d0e4b2edd70
-
SHA256
761114840822ac2ca103b8def7f30264034b0b783bed1127ba27ae5e13987d46
-
SHA512
6d6b18856ddc7aa192528e7621cf5c4e2b817885b2c1c973428ed6ef73c66d5c81d94acf24b96765189d3e10badcdb44c9a4d52838344c114a56001ea0eafcaf
Score
10/10
Malware Config
Extracted
Family
icedid
Extracted
Family
icedid
Botnet
2794990697
C2
sheaffic.org
memphase.com
vulcate.com
sheaffic.com
eurobable.com
Attributes
-
auth_var
1
-
url_path
/index.php
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
IcedID Second Stage Loader 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\761114840822ac2ca103b8def7f30264034b0b783bed1127ba27ae5e13987d46.exe"C:\Users\Admin\AppData\Local\Temp\761114840822ac2ca103b8def7f30264034b0b783bed1127ba27ae5e13987d46.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4928-131-0x0000000000AB0000-0x0000000000C77000-memory.dmpFilesize
1.8MB
-
memory/4928-132-0x0000000000AB0000-0x0000000000C77000-memory.dmpFilesize
1.8MB
-
memory/4928-133-0x0000000000AB0000-0x0000000000AB5000-memory.dmpFilesize
20KB
-
memory/4928-134-0x0000000000AB0000-0x0000000000C77000-memory.dmpFilesize
1.8MB