icedid | d3fddc340951891f898b146b6bdc6a74e2a9879b63d414ba9bf21fef2c825efd | Triage

Analysis

max time kernel
151s
max time network
147s
platform
windows10_x64
resource
win10v20210408
submitted
26-07-2021 22:23

Sharing

Report Analysis Logs

General

Target

5901ea6a05e2a188d0cf47dcdff547fad95e49213d5abd4df6a53f8fe4cbbb25.exe
Size

301KB
MD5

142ad6fd67491183aa6fd7dc2533060b
SHA1

821c060e4ef4762a460119d68f6fedd3c5e488ee
SHA256

5901ea6a05e2a188d0cf47dcdff547fad95e49213d5abd4df6a53f8fe4cbbb25
SHA512

2ac1379cb009af4ddf0f37dc4e566d1ed1e64e5e6ca12a7bd05f98cb5d889838aa5f2ff5fa6f175413353a3f6e6634938d7ba56cc32d0833a2ee7a936b0bbec2

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

lookatnice.top

littyfahren.club

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/656-114-0x0000000001000000-0x0000000001006000-memory.dmp	IcedidSecondLoader

C:\Users\Admin\AppData\Local\Temp\5901ea6a05e2a188d0cf47dcdff547fad95e49213d5abd4df6a53f8fe4cbbb25.exe
"C:\Users\Admin\AppData\Local\Temp\5901ea6a05e2a188d0cf47dcdff547fad95e49213d5abd4df6a53f8fe4cbbb25.exe"
1⤵
PID:656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-114-0x0000000001000000-0x0000000001006000-memory.dmp

Filesize
24KB

Download
memory/656-115-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download