icedid | 76cd290b236b11bd18d81e75e41682208e4c0a5701ce7834a9e289ea9e06eb7e | Triage

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7v20201028
submitted
04-03-2021 11:48

Sharing

Report Analysis Logs

General

Target

new_iceid_loader.exe_.exe
Size

142KB
MD5

17091a1e444f306b928d69f2b905bc8b
SHA1

1078744833050626e9681c7c233c3a0963a0b559
SHA256

76cd290b236b11bd18d81e75e41682208e4c0a5701ce7834a9e289ea9e06eb7e
SHA512

4a62f6a289f06b90d6ca080793cf4ae85e1adca3c2d83c66375ae6458f8ed9d58d7e57649634d7e4a722e7c1f252156883641c822590d38c70d9dbadec6fa29d

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

boldidiotruss.xyz

nizaoplov.xyz

153ishak.best

ilu21plane.xyz

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/776-3-0x0000000001020000-0x0000000001025000-memory.dmp	IcedidSecondLoader

C:\Users\Admin\AppData\Local\Temp\new_iceid_loader.exe_.exe
"C:\Users\Admin\AppData\Local\Temp\new_iceid_loader.exe_.exe"
1⤵
PID:776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/776-2-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/776-3-0x0000000001020000-0x0000000001025000-memory.dmp

Filesize
20KB

Download
memory/776-4-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download