icedid | 42769cd17b00671f1a38030e4641745117b20924e1e65ad156a8af77210b9588 | Triage

Analysis

max time kernel
151s
max time network
81s
platform
windows7_x64
resource
win7-20220414-en
submitted
27-04-2022 15:33

Sharing

Report Analysis Logs

General

Target

42769cd17b00671f1a38030e4641745117b20924e1e65ad156a8af77210b9588.exe
Size

386KB
MD5

1a0c60a67a3d71862b8631d2dc359e3b
SHA1

dd38e197d21a8746502541fa72b4f37fc22c940f
SHA256

42769cd17b00671f1a38030e4641745117b20924e1e65ad156a8af77210b9588
SHA512

b01b0ffd9e07fc5807d6fd92a5ec2cf350d928a973cae8012f7bbcfb3642caae0d457231a810ab77839f81c4ae49dd000f88d98e5af8a759845e6bf69dd4376c

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

freeharritage.top

gohoemmuzlimanz.best

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1112-55-0x00000000002E0000-0x00000000002E6000-memory.dmp	IcedidSecondLoader
behavioral1/memory/1112-56-0x00000000002E0000-0x00000000003C2000-memory.dmp	IcedidSecondLoader

C:\Users\Admin\AppData\Local\Temp\42769cd17b00671f1a38030e4641745117b20924e1e65ad156a8af77210b9588.exe
"C:\Users\Admin\AppData\Local\Temp\42769cd17b00671f1a38030e4641745117b20924e1e65ad156a8af77210b9588.exe"
1⤵
PID:1112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1112-55-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/1112-56-0x00000000002E0000-0x00000000003C2000-memory.dmp

Filesize
904KB

Download