Overview

overview

10

Static

static

a056b2322d...42.exe

windows7-x64

10

a056b2322d...42.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    24-07-2022 14:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a056b2322dcfd6c348864feb7cf3c228b384e520711cd0ec5a95bb90c2959142.exe

  • Size

    456KB

  • MD5

    c04f5dc534fa5b1acef3c08d9ab3f3cb

  • SHA1

    fc0e221a14b8e196a4c03859051c5212b91544ac

  • SHA256

    a056b2322dcfd6c348864feb7cf3c228b384e520711cd0ec5a95bb90c2959142

  • SHA512

    39f23432000e2595563a542b264318cd94fe0a0ab33692a071fc3c44f7956f0002b85af5e6fbb275d98eace954f752922ace6194db86b4c24b68553e5114cc05

Score
10/10
icedid548174735bankerloadertrojan

Malware Config

Extracted

Family

icedid

Botnet

548174735

C2

magnwnce.com

corposted.com

presifered.com

coujtried.com

molinaro.top

amongolia.com

jjanuatu.com
Attributes
  • auth_var

    3

  • url_path

    /index.php

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • IcedID Second Stage Loader 1 IoCs
    loader
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a056b2322dcfd6c348864feb7cf3c228b384e520711cd0ec5a95bb90c2959142.exe
    "C:\Users\Admin\AppData\Local\Temp\a056b2322dcfd6c348864feb7cf3c228b384e520711cd0ec5a95bb90c2959142.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1868-58-0x00000000003E0000-0x00000000003E7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1868-57-0x00000000003E0000-0x00000000003E7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1868-60-0x00000000003E0000-0x00000000003E7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1868-59-0x00000000003E0000-0x00000000003E7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1868-61-0x00000000003E0000-0x00000000003E7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1868-62-0x00000000003E0000-0x00000000003E7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1868-63-0x00000000003E0000-0x00000000003E7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1868-66-0x00000000003E0000-0x00000000003E7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1868-67-0x00000000003E0000-0x00000000003E7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1868-65-0x00000000003E0000-0x00000000003E7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1868-64-0x00000000003E0000-0x00000000003E7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1868-68-0x00000000003E0000-0x00000000003E7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1868-69-0x00000000003E0000-0x00000000003E7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/1868-70-0x0000000075D41000-0x0000000075D43000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1868-71-0x00000000003F0000-0x00000000003F5000-memory.dmp
    Filesize

    20KB

    Download
  • memory/1868-75-0x00000000003E0000-0x00000000003E7000-memory.dmp
    Filesize

    28KB

    Download