icedid | 986431aedfa86035df63782c28f72330c9d6cfd17d346e5ab355ce0ecc258c60 | Triage

Analysis

max time kernel
203s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
27-04-2022 15:33

Sharing

Report Analysis Logs

General

Target

986431aedfa86035df63782c28f72330c9d6cfd17d346e5ab355ce0ecc258c60.exe
Size

386KB
MD5

9b0b27e8ff72c99e3592ed1643a3a63a
SHA1

643d1dfb9e2edbd627a3ed5c0d3541288a170605
SHA256

986431aedfa86035df63782c28f72330c9d6cfd17d346e5ab355ce0ecc258c60
SHA512

24afa771dd27c07010707cb990494ab227b45fe3a5897f129eb34fece60d0b8e950deecc198d0b7288332c067386dde27d8c95f4a3c6d63815c67337761383d9

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

freeharritage.top

gohoemmuzlimanz.best

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2368-130-0x0000000000C20000-0x0000000000C26000-memory.dmp	IcedidSecondLoader
behavioral2/memory/2368-131-0x0000000000C20000-0x0000000000D02000-memory.dmp	IcedidSecondLoader

C:\Users\Admin\AppData\Local\Temp\986431aedfa86035df63782c28f72330c9d6cfd17d346e5ab355ce0ecc258c60.exe
"C:\Users\Admin\AppData\Local\Temp\986431aedfa86035df63782c28f72330c9d6cfd17d346e5ab355ce0ecc258c60.exe"
1⤵
PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2368-130-0x0000000000C20000-0x0000000000C26000-memory.dmp

Filesize
24KB

Download
memory/2368-131-0x0000000000C20000-0x0000000000D02000-memory.dmp

Filesize
904KB

Download