Analysis
-
max time kernel
104s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
19/04/2025, 20:18
General
-
Target
2025-04-19_aab9c3fe916caca1e43641806e5fb5b5_elex_icedid.exe
-
Size
296KB
-
MD5
aab9c3fe916caca1e43641806e5fb5b5
-
SHA1
25decdd748eef9f964b76cff5225e5d0d672fb47
-
SHA256
68ee00ee736714ef1a247a34db582392ff75dd886c987b373fb4877e4e4fcf6d
-
SHA512
e11a8824d0108582f4690e6699be289a726c4f926baa58afb6b45481f008b5e04b763527df3de55b53c89b9645b361a21432b19e16139a9a362993d31f88e4f8
-
SSDEEP
3072:iLsPk8GT/OxyVXbh0d1iaP7nP31euHuGqhwQ217U/wFcwDlv1+sZ0be8OBmD:wss8Q/OYdJaznP3lfq65Uw++0Bi
Score
10/10
Malware Config
Extracted
Family
icedid
Extracted
Family
icedid
Botnet
2258898682
C2
enricowilli.top
lagunaway.top
teoreticaldanger.pw
uxanlabchina.top
Attributes
-
auth_var
5
-
url_path
/audio/
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
Icedid family
-
IcedID Second Stage Loader 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-04-19_aab9c3fe916caca1e43641806e5fb5b5_elex_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-19_aab9c3fe916caca1e43641806e5fb5b5_elex_icedid.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
-
Filesize
24KB