Overview

overview

10

Static

static

Setup_Win_...13.exe

windows7-x64

10

Setup_Win_...13.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    125s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-01-2023 14:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Setup_Win_18-01-2023_17-44-13.exe

  • Size

    700.4MB

  • MD5

    6718a804f5d5064fa3b918d844fd727d

  • SHA1

    16cfb4a72bd1c8e8f67a8a5687e118c3774f84f0

  • SHA256

    030e7b73e8d7bb187183f3087b8ec5756a8c71698f198754cf5299c86e044199

  • SHA512

    e739f4a7d59f7c68600c528cd5fc15f87ca148200331fae8f058d18640baadbf5fa1d45c3d884e249cab52256ebeddb3faecc1a51ddcc63c34be816ebc955bd0

  • SSDEEP

    6144:1zzkhbh8r2y6gudO7sBdvkJ5mXWboh4cd1gJkrW4MqR823v1djjJIAOV4Eq:1EhbGjyY7sncGXWbo3d9MqRnjjGAnR

Score
10/10
icedid3248465841bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

3248465841

C2

qsertopinajil.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup_Win_18-01-2023_17-44-13.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup_Win_18-01-2023_17-44-13.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1096-54-0x000007FEFB6F1000-0x000007FEFB6F3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1096-55-0x0000000000210000-0x0000000000218000-memory.dmp
    Filesize

    32KB

    Download
  • memory/1096-61-0x0000000140000000-0x0000000140071000-memory.dmp
    Filesize

    452KB

    Download