Overview

overview

10

Static

static

icedid_out.exe

windows7-x64

10

icedid_out.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-01-2023 03:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    icedid_out.exe

  • Size

    229KB

  • MD5

    2e6808a4d0c8cfd1d9a347f8cf80dc6d

  • SHA1

    8e91332481b033b4af9c24f65e3d24b10e60234b

  • SHA256

    dfb3e5f557a17c8cdebdb5b371cf38c5a7ab491b2aeaad6b4e76459a05b44f28

  • SHA512

    f631e6b7396a552486debadd205a1be94975400e34a3628fd542c3587f31ab14b3d6dc780f4f7768b5c143efd7df9ed95bdc20047a8272f22d9355f2e10e65bc

  • SSDEEP

    6144:XEwzu35pbRYlB/DZxT+O3whxYVcLX+xf8OB3hceW:XzmolB/rTx3whxYOPWq

Score
10/10
icedid1392658338bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

1392658338

C2

nrncipalmoonw.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\icedid_out.exe
    "C:\Users\Admin\AppData\Local\Temp\icedid_out.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2728-132-0x0000000140000000-0x0000000140008000-memory.dmp
    Filesize

    32KB

    Download