Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220722-en - resource tags
- submitted
25/07/2022, 03:51
General
- Target 58c8518a85d32448881050757f6a8b0468636d3ebb74315023d9963b32355501.exe
- Size 376KB
- Sample220725-eeta6sdea5
- SHA256 58c8518a85d32448881050757f6a8b0468636d3ebb74315023d9963b32355501
Malware Config
Extracted
-
icedid
-
513366864
-
magnwnce.com
-
corposted.com
-
presifered.com
-
coujtried.com
-
molinaro.top
-
amongolia.com
-
jjanuatu.com
-
auth_var
11
-
url_path
/index.php
Signatures
- IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
- IcedID Second Stage Loader 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\58c8518a85d32448881050757f6a8b0468636d3ebb74315023d9963b32355501.exe"C:\Users\Admin\AppData\Local\Temp\58c8518a85d32448881050757f6a8b0468636d3ebb74315023d9963b32355501.exe"1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3760-136-0x0000000002AC0000-0x0000000002AC3000-memory.dmp
memory/3760-135-0x0000000002AC0000-0x0000000002AC3000-memory.dmp
memory/3760-137-0x0000000002AC0000-0x0000000002AC3000-memory.dmp
memory/3760-138-0x0000000002AC0000-0x0000000002AC3000-memory.dmp
memory/3760-139-0x0000000002AC0000-0x0000000002AC3000-memory.dmp
memory/3760-140-0x0000000002AC0000-0x0000000002AC3000-memory.dmp
memory/3760-141-0x0000000002AC0000-0x0000000002AC3000-memory.dmp
memory/3760-142-0x0000000002AC0000-0x0000000002AC3000-memory.dmp
memory/3760-143-0x0000000002AC0000-0x0000000002AC3000-memory.dmp
memory/3760-145-0x0000000002AC0000-0x0000000002AC3000-memory.dmp
memory/3760-144-0x0000000002AC0000-0x0000000002AC3000-memory.dmp
memory/3760-146-0x0000000002AC0000-0x0000000002AC3000-memory.dmp
memory/3760-147-0x0000000002AC0000-0x0000000002AC3000-memory.dmp
memory/3760-148-0x0000000002AC0000-0x0000000002AC3000-memory.dmp
memory/3760-149-0x0000000002AD0000-0x0000000002AD5000-memory.dmp