Overview

overview

10

Static

static

dc6e35d1e5...56.exe

windows7_x64

10

dc6e35d1e5...56.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    183s
  • max time network
    197s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    01-07-2022 07:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dc6e35d1e55d1d77039e026b647c19d975114c02a541327770688eee00912f56.exe

  • Size

    380KB

  • MD5

    10da99c2fa3cc2722a5da7ce984f43cb

  • SHA1

    9b4b7272f2feb3754d994c20006f0796c3a215a8

  • SHA256

    dc6e35d1e55d1d77039e026b647c19d975114c02a541327770688eee00912f56

  • SHA512

    4532460685f6ca3af148b56719e37cbaf41323fef554d89995b78fc37ceaf7bfad19c60e5bb09cce73441819c2ef75ceb6817b05c7da94c6290cfbb6b4d578b2

Score
10/10
icedid1604739030bankerloadertrojan

Malware Config

Extracted

Family

icedid

Botnet

1604739030

C2

gerontos.top

derilopa.top

desreona.top

seniorex.top

dezaredo.top

netionax.top

gerrredona.top

nameseorin.top

dirosad.top

colonisfg.com
Attributes
  • auth_var

    2

  • url_path

    /index.php

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • IcedID Second Stage Loader 1 IoCs
    loader
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc6e35d1e55d1d77039e026b647c19d975114c02a541327770688eee00912f56.exe
    "C:\Users\Admin\AppData\Local\Temp\dc6e35d1e55d1d77039e026b647c19d975114c02a541327770688eee00912f56.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1544-57-0x0000000075371000-0x0000000075373000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-58-0x0000000000720000-0x0000000000725000-memory.dmp

    Filesize

    20KB

    Download