icedid | 59bc91f38609631e71b97685bc751efc10fe0a022a457c72eb853b0a6a94381f | Triage

Analysis

max time kernel
4294208s
max time network
143s
platform
windows7_x64
resource
win7-20220310-en
submitted
26-03-2022 22:15

Sharing

Report Analysis Logs

General

Target

59bc91f38609631e71b97685bc751efc10fe0a022a457c72eb853b0a6a94381f.exe
Size

144KB
MD5

15df2bbb0fafeaddec2a60991f204868
SHA1

6f82a9d4c280ad033e9da26d3e1d3840d34179f2
SHA256

59bc91f38609631e71b97685bc751efc10fe0a022a457c72eb853b0a6a94381f
SHA512

8bef61d5a7a7138652f4af5cd9378e1bff0816bb5a5250f0ec6333d4ae79afa562e8eaad8749df7bd66961d5880e59fa4ef7887b461d9ad9ad0b99e96b9da54a

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

lysterpad.top

angiliaisland.best

asterioidglowo.club

greedyfopolo.best

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1640-55-0x0000000000C30000-0x0000000000C36000-memory.dmp	IcedidSecondLoader
behavioral1/memory/1640-56-0x0000000000C30000-0x0000000000C77000-memory.dmp	IcedidSecondLoader

C:\Users\Admin\AppData\Local\Temp\59bc91f38609631e71b97685bc751efc10fe0a022a457c72eb853b0a6a94381f.exe
"C:\Users\Admin\AppData\Local\Temp\59bc91f38609631e71b97685bc751efc10fe0a022a457c72eb853b0a6a94381f.exe"
1⤵
PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-54-0x0000000076361000-0x0000000076363000-memory.dmp

Filesize
8KB

Download
memory/1640-55-0x0000000000C30000-0x0000000000C36000-memory.dmp

Filesize
24KB

Download
memory/1640-56-0x0000000000C30000-0x0000000000C77000-memory.dmp

Filesize
284KB

Download