icedid | 9c3ee16288af89bed69166f1e1690769f0b563c2c2ef1277c6dceaec514e3652 | Triage

Analysis

max time kernel
153s
max time network
127s
platform
windows7_x64
resource
win7-20220414-en
submitted
07-05-2022 20:36

Sharing

Report Analysis Logs

General

Target

9c3ee16288af89bed69166f1e1690769f0b563c2c2ef1277c6dceaec514e3652.exe
Size

238KB
MD5

d7a233713cc5a33fd5b9a5aae94424e9
SHA1

2e93c381c0beca903be5b2f4a35fc822658525fd
SHA256

9c3ee16288af89bed69166f1e1690769f0b563c2c2ef1277c6dceaec514e3652
SHA512

0596b70a987b01414522f66f4968539ccf86cd8bce71c558487e00f4ff7a337b08339f363032328a6e293dddd48945eb78f8b1078a3847ab6713556f47889237

Score

10^/10

icedid 2635507097 banker loader trojan

Malware Config

Extracted

Family

icedid

Extracted

Family

icedid

Botnet

2635507097

C2

rufepuksuka.cyou

uzhokpidarok.cyou

Attributes

auth_var
1
url_path
/audio/

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1796-55-0x0000000000D70000-0x0000000000EAC000-memory.dmp	IcedidSecondLoader
behavioral1/memory/1796-56-0x0000000000D70000-0x0000000000D76000-memory.dmp	IcedidSecondLoader

C:\Users\Admin\AppData\Local\Temp\9c3ee16288af89bed69166f1e1690769f0b563c2c2ef1277c6dceaec514e3652.exe
"C:\Users\Admin\AppData\Local\Temp\9c3ee16288af89bed69166f1e1690769f0b563c2c2ef1277c6dceaec514e3652.exe"
1⤵
PID:1796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1796-54-0x0000000075951000-0x0000000075953000-memory.dmp

Filesize
8KB

Download
memory/1796-55-0x0000000000D70000-0x0000000000EAC000-memory.dmp

Filesize
1.2MB

Download
memory/1796-56-0x0000000000D70000-0x0000000000D76000-memory.dmp

Filesize
24KB

Download