icedid | ac1d19c5942946f9eee6bc748dee032b97eb3ec3e4bb64fead3e5ac101fb1bc8 | Triage™

Analysis

max time kernel
132s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
14/04/2022, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c52150ad226963a07cfc144d9cea73c7.exe
Size 2.1MB
Sample220414-ymjaqadffq
SHA256 ac1d19c5942946f9eee6bc748dee032b97eb3ec3e4bb64fead3e5ac101fb1bc8
MD5 c52150ad226963a07cfc144d9cea73c7
SHA1 235912e865829ae7b9196fc4a1df4dfe8123dcfb
SHA512 43ae77c0e0c94e7b9525906dae115497c7dd49afabccd64d37b224e75931b09bff8dedf81a9cd3bf9454f75e4a67c4355f19dd8bcbe25b8b06eee32f2240a7cc
MD5 SHA1 SHA512

Score

10^/10

icedid 2352744503 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

2352744503

C2

rivertimad.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/4172-130-0x0000000140000000-0x000000014000B000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4172	c52150ad226963a07cfc144d9cea73c7.exe
4172	c52150ad226963a07cfc144d9cea73c7.exe

C:\Users\Admin\AppData\Local\Temp\c52150ad226963a07cfc144d9cea73c7.exe
"C:\Users\Admin\AppData\Local\Temp\c52150ad226963a07cfc144d9cea73c7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4172-130-0x0000000140000000-0x000000014000B000-memory.dmp

Download