icedid | a1d05aa1324fdc04e7698fbc3a4f212013b2bf7d7531b317d0b76e832d97a841 | Triage

Analysis

max time kernel
137s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
29-03-2022 19:19

Sharing

Report Analysis Logs

General

Target

a1d05aa1324fdc04e7698fbc3a4f212013b2bf7d7531b317d0b76e832d97a841.exe
Size

104KB
MD5

bf5309d3536cb55f8a052ad35576866f
SHA1

db0d76c50077280cc66b6d7c0084472575c235f8
SHA256

a1d05aa1324fdc04e7698fbc3a4f212013b2bf7d7531b317d0b76e832d97a841
SHA512

ff06f9b89ca1e886887e5866f90775c2e56701491215e99d933b786ec75758095c00dba22ec5daba5a7ed1bdb3fab415ddb5922715bd3da32e237dca50ada4c8

Score

10^/10

icedid 1798566902 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1798566902

C2

rivertimad.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4024-133-0x0000000140000000-0x000000014000B000-memory.dmp	IcedidFirstLoader

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3516 4024 WerFault.exe a1d05aa1324fdc04e7698fbc3a4f212013b2bf7d7531b317d0b76e832d97a841.exe

C:\Users\Admin\AppData\Local\Temp\a1d05aa1324fdc04e7698fbc3a4f212013b2bf7d7531b317d0b76e832d97a841.exe
"C:\Users\Admin\AppData\Local\Temp\a1d05aa1324fdc04e7698fbc3a4f212013b2bf7d7531b317d0b76e832d97a841.exe"
1⤵
PID:4024

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4024 -s 168
2⤵
- Program crash
PID:3516

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 4024 -ip 4024
1⤵
PID:1688

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4024-133-0x0000000140000000-0x000000014000B000-memory.dmp

Filesize
44KB

Download