icedid | 20dc04a7bfaed2ae9ce0f33414e7bc577e2ef7b96910e481b5acda85a2f10b10 | Triage

Analysis

max time kernel
147s
max time network
93s
platform
windows7_x64
resource
win7-20220414-en
submitted
17-04-2022 07:47

Sharing

Report Analysis Logs

General

Target

20dc04a7bfaed2ae9ce0f33414e7bc577e2ef7b96910e481b5acda85a2f10b10.exe
Size

547KB
MD5

a127ea2f74a0991c48cc8ca2cfa2d5b6
SHA1

6921e0f6aae2331ed739c23ed34fdcf677a4a79c
SHA256

20dc04a7bfaed2ae9ce0f33414e7bc577e2ef7b96910e481b5acda85a2f10b10
SHA512

b9b78e9de464d9c927e4da63b85d4c219475045120e170cb4ec6fb3a57e88032df79b1dc0eb99cf93678c512b7dfc955425a351f4bbab01f64ca50bf3883e49d

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

justiceminister.best

fivejudgescatholic.cyou

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/584-55-0x0000000000B80000-0x0000000000D03000-memory.dmp	IcedidSecondLoader
behavioral1/memory/584-56-0x0000000000B80000-0x0000000000B86000-memory.dmp	IcedidSecondLoader

C:\Users\Admin\AppData\Local\Temp\20dc04a7bfaed2ae9ce0f33414e7bc577e2ef7b96910e481b5acda85a2f10b10.exe
"C:\Users\Admin\AppData\Local\Temp\20dc04a7bfaed2ae9ce0f33414e7bc577e2ef7b96910e481b5acda85a2f10b10.exe"
1⤵
PID:584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-54-0x00000000759E1000-0x00000000759E3000-memory.dmp

Filesize
8KB

Download
memory/584-55-0x0000000000B80000-0x0000000000D03000-memory.dmp

Filesize
1.5MB

Download
memory/584-56-0x0000000000B80000-0x0000000000B86000-memory.dmp

Filesize
24KB

Download