Analysis

  • max time kernel
    10s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2023, 04:01 UTC

General

  • Target

    6fa0ea46cdf13cc71d9a164d0291f481d3947ec4f35f2cbf7b5c4a51ae3b0aed.exe

  • Size

    5.0MB

  • MD5

    6865ca56665542cd7d5c1c53a76f32ca

  • SHA1

    a8c9c66b632f5d2fda9d30f765ebc96ea4123c7a

  • SHA256

    6fa0ea46cdf13cc71d9a164d0291f481d3947ec4f35f2cbf7b5c4a51ae3b0aed

  • SHA512

    ae134bb33333ebbed97acf52a67310b191fe03899bcb1948f3da3a89c04c9d00a892cd0f9190cfd4fef258719cc9f66c87e75bed2d87f9d342f9bb46d6f68505

  • SSDEEP

    49152:ptErfhsOSMa1xYus4Q2D2TgG6hN3gSVsmqoyeBe4:ptEbfa1xNL2g3mrEB/

Malware Config

Extracted

Family

icedid

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

  • Matiex Main payload 1 IoCs
  • Detectes Phoenix Miner Payload 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6fa0ea46cdf13cc71d9a164d0291f481d3947ec4f35f2cbf7b5c4a51ae3b0aed.exe
    "C:\Users\Admin\AppData\Local\Temp\6fa0ea46cdf13cc71d9a164d0291f481d3947ec4f35f2cbf7b5c4a51ae3b0aed.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:940
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 48
      2⤵
      • Program crash
      PID:1100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/940-54-0x00000000006B0000-0x0000000000BB01E0-memory.dmp

    Filesize

    5.0MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.