Overview

overview

10

Static

static

4215e9ef11...01.exe

windows7_x64

10

4215e9ef11...01.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    163s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    08-07-2022 03:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4215e9ef112907ed9910953ec243a93f9e689fe94c4170b35baca4ee6d1fc901.exe

  • Size

    804KB

  • MD5

    c8ae7258ec9a1b00849267b930ad2719

  • SHA1

    77aec7943e05f4bbc5bd9118a8f1e9d327b4c9e7

  • SHA256

    4215e9ef112907ed9910953ec243a93f9e689fe94c4170b35baca4ee6d1fc901

  • SHA512

    df02215e2376cc8e0b9fb5c18c855b614816b7e1202f1b0aef544f4f27347294c8595395396045a4db8f498ae6be72e724ae1ac251f0bd80c297e86211a1cf24

Score
10/10
icedid548174735bankerloadertrojan

Malware Config

Extracted

Family

icedid

Botnet

548174735

C2

gfthwards.com

gfthwards.eu

gfthwards.net

presifered.com

coujtried.com
Attributes
  • auth_var

    2

  • url_path

    /index.php

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • IcedID Second Stage Loader 1 IoCs
    loader
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4215e9ef112907ed9910953ec243a93f9e689fe94c4170b35baca4ee6d1fc901.exe
    "C:\Users\Admin\AppData\Local\Temp\4215e9ef112907ed9910953ec243a93f9e689fe94c4170b35baca4ee6d1fc901.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1964-57-0x0000000000240000-0x0000000000243000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1964-56-0x0000000000240000-0x0000000000243000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1964-59-0x0000000000240000-0x0000000000243000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1964-58-0x0000000000240000-0x0000000000243000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1964-61-0x0000000000240000-0x0000000000243000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1964-60-0x0000000000240000-0x0000000000243000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1964-63-0x0000000000240000-0x0000000000243000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1964-62-0x0000000000240000-0x0000000000243000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1964-64-0x0000000000240000-0x0000000000243000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1964-65-0x0000000000240000-0x0000000000243000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1964-66-0x0000000000240000-0x0000000000243000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1964-67-0x0000000000240000-0x0000000000243000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1964-68-0x0000000000240000-0x0000000000243000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1964-69-0x0000000075FC1000-0x0000000075FC3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1964-70-0x0000000000340000-0x0000000000345000-memory.dmp
    Filesize

    20KB

    Download
  • memory/1964-74-0x0000000000240000-0x0000000000243000-memory.dmp
    Filesize

    12KB

    Download