icedid | 9c3ee16288af89bed69166f1e1690769f0b563c2c2ef1277c6dceaec514e3652 | Triage

Analysis

max time kernel
171s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
07-05-2022 20:36

Sharing

Report Analysis Logs

General

Target

9c3ee16288af89bed69166f1e1690769f0b563c2c2ef1277c6dceaec514e3652.exe
Size

238KB
MD5

d7a233713cc5a33fd5b9a5aae94424e9
SHA1

2e93c381c0beca903be5b2f4a35fc822658525fd
SHA256

9c3ee16288af89bed69166f1e1690769f0b563c2c2ef1277c6dceaec514e3652
SHA512

0596b70a987b01414522f66f4968539ccf86cd8bce71c558487e00f4ff7a337b08339f363032328a6e293dddd48945eb78f8b1078a3847ab6713556f47889237

Score

10^/10

icedid 2635507097 banker loader trojan

Malware Config

Extracted

Family

icedid

Extracted

Family

icedid

Botnet

2635507097

C2

rufepuksuka.cyou

uzhokpidarok.cyou

Attributes

auth_var
1
url_path
/audio/

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2064-131-0x0000000000B70000-0x0000000000CAC000-memory.dmp	IcedidSecondLoader
behavioral2/memory/2064-132-0x0000000000B70000-0x0000000000B76000-memory.dmp	IcedidSecondLoader

C:\Users\Admin\AppData\Local\Temp\9c3ee16288af89bed69166f1e1690769f0b563c2c2ef1277c6dceaec514e3652.exe
"C:\Users\Admin\AppData\Local\Temp\9c3ee16288af89bed69166f1e1690769f0b563c2c2ef1277c6dceaec514e3652.exe"
1⤵
PID:2064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-131-0x0000000000B70000-0x0000000000CAC000-memory.dmp

Filesize
1.2MB

Download
memory/2064-132-0x0000000000B70000-0x0000000000B76000-memory.dmp

Filesize
24KB

Download