icedid | 2b885b93e9c8ca7fa984a1ce4480febc4a7ed132c7e020714fd982c4b91fcc45 | Triage

Analysis

max time kernel
152s
max time network
203s
platform
windows7_x64
resource
win7-20220414-en
submitted
08-05-2022 03:19

Sharing

Report Analysis Logs

General

Target

2b885b93e9c8ca7fa984a1ce4480febc4a7ed132c7e020714fd982c4b91fcc45.exe
Size

1.4MB
MD5

e5552b7fb09cd4ffef80ff2ac6f858cf
SHA1

5d1493056760d793ddb129b5c41e2e2d93e76575
SHA256

2b885b93e9c8ca7fa984a1ce4480febc4a7ed132c7e020714fd982c4b91fcc45
SHA512

058daa06836238d8f91da7c6e1680fdcafbac4e44fe9fd5dbeebb8e638be05037cd4f4bef71682ff1a70105bdddcdc3ff3b15d9a42598a3d6805236f45339142

Score

10^/10

icedid 345673251 banker loader trojan

Malware Config

Extracted

Family

icedid

Extracted

Family

icedid

Botnet

345673251

C2

supportayzer.shop

bookoffathes.pw

Attributes

auth_var
1
url_path
/audio/

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1968-55-0x00000000004E0000-0x000000000074B000-memory.dmp	IcedidSecondLoader
behavioral1/memory/1968-56-0x00000000004E0000-0x00000000004E6000-memory.dmp	IcedidSecondLoader

C:\Users\Admin\AppData\Local\Temp\2b885b93e9c8ca7fa984a1ce4480febc4a7ed132c7e020714fd982c4b91fcc45.exe
"C:\Users\Admin\AppData\Local\Temp\2b885b93e9c8ca7fa984a1ce4480febc4a7ed132c7e020714fd982c4b91fcc45.exe"
1⤵
PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-54-0x00000000765C1000-0x00000000765C3000-memory.dmp

Filesize
8KB

Download
memory/1968-55-0x00000000004E0000-0x000000000074B000-memory.dmp

Filesize
2.4MB

Download
memory/1968-56-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download