icedid | ef59acbe03880ac8941ad3f36cd8d2cf0c5d86c9c19edf0bd45c0ec289a8ca83 | Triage

Analysis

max time kernel
188s
max time network
198s
platform
windows7_x64
resource
win7-20220414-en
submitted
08-05-2022 16:40

Sharing

Report Analysis Logs

General

Target

ef59acbe03880ac8941ad3f36cd8d2cf0c5d86c9c19edf0bd45c0ec289a8ca83.exe
Size

234KB
MD5

4bed6fac80dd4de89d8208858a5d74b4
SHA1

dc81338df166bc7573251bbfa0f05a7d035627c3
SHA256

ef59acbe03880ac8941ad3f36cd8d2cf0c5d86c9c19edf0bd45c0ec289a8ca83
SHA512

db615539189dddba6b14c53bd7d17bbece81ce942451491559d3cb284ae0094f4edd1028df80f34073a26e8f92c20931b4c97c77fcd826d511216fd1b5d29ca1

Score

10^/10

icedid 2634746917 banker loader trojan

Malware Config

Extracted

Family

icedid

Extracted

Family

icedid

Botnet

2634746917

C2

june85.cyou

golddisco.top

Attributes

auth_var
1
url_path
/audio/

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1936-55-0x0000000001000000-0x000000000113A000-memory.dmp	IcedidSecondLoader
behavioral1/memory/1936-56-0x0000000001000000-0x0000000001006000-memory.dmp	IcedidSecondLoader

C:\Users\Admin\AppData\Local\Temp\ef59acbe03880ac8941ad3f36cd8d2cf0c5d86c9c19edf0bd45c0ec289a8ca83.exe
"C:\Users\Admin\AppData\Local\Temp\ef59acbe03880ac8941ad3f36cd8d2cf0c5d86c9c19edf0bd45c0ec289a8ca83.exe"
1⤵
PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-54-0x00000000763E1000-0x00000000763E3000-memory.dmp

Filesize
8KB

Download
memory/1936-55-0x0000000001000000-0x000000000113A000-memory.dmp

Filesize
1.2MB

Download
memory/1936-56-0x0000000001000000-0x0000000001006000-memory.dmp

Filesize
24KB

Download