icedid | 4939b61eb011cc10deba126cd09a2106b7ed7c1e41895c00a3de388ca1c5348d | Triage™

Analysis

max time kernel
158s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08/05/2022, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4939b61eb011cc10deba126cd09a2106b7ed7c1e41895c00a3de388ca1c5348d.exe
Size 405KB
Sample220508-s1396aahe8
SHA256 4939b61eb011cc10deba126cd09a2106b7ed7c1e41895c00a3de388ca1c5348d
MD5 d7e0c89bbb42aef8d64f97a0efb6b1b0
SHA1 1600e95f0b4c4dd545adcaefe2ffb1c93eb89989
SHA512 4b46b5e8ca257e6c51e218cb7c6ce17919a11ea9567868bfe02b22352752ec50e716804a1cce31c6fe26db55135728614353e8491cb81e15eae7a238b7514c21
MD5 SHA1 SHA512

Score

10^/10

icedid 4253634279 banker loader trojan

Malware Config

Extracted

Family

icedid

Extracted

Family

icedid

Botnet

4253634279

C2

90volizmu.pw
sellsold.pw

Attributes

auth_var
2
url_path
/audio/

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

resource	yara_rule
behavioral2/memory/1052-130-0x0000000000650000-0x00000000007B5000-memory.dmp	IcedidSecondLoader
behavioral2/memory/1052-131-0x0000000000650000-0x0000000000656000-memory.dmp	IcedidSecondLoader

C:\Users\Admin\AppData\Local\Temp\4939b61eb011cc10deba126cd09a2106b7ed7c1e41895c00a3de388ca1c5348d.exe
"C:\Users\Admin\AppData\Local\Temp\4939b61eb011cc10deba126cd09a2106b7ed7c1e41895c00a3de388ca1c5348d.exe"
1⤵
PID:1052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1052-130-0x0000000000650000-0x00000000007B5000-memory.dmp

Download

memory/1052-131-0x0000000000650000-0x0000000000656000-memory.dmp

Download