icedid | 77a403ad73f8f6b4dd09f90d1aa10f7f205e86ff2e14cacc0afb7d8a6ef98dfe | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20220414-en
submitted
08-05-2022 16:40

Sharing

Report Analysis Logs

General

Target

77a403ad73f8f6b4dd09f90d1aa10f7f205e86ff2e14cacc0afb7d8a6ef98dfe.exe
Size

1.4MB
MD5

0a8b8ed31e374f570ce8a5c0800ee3e1
SHA1

af00de5748f8bb5e8ed6836863eb62992392ae2a
SHA256

77a403ad73f8f6b4dd09f90d1aa10f7f205e86ff2e14cacc0afb7d8a6ef98dfe
SHA512

f984cc71bae00c68cd227705eb9e6f3247b761245afc40a0d73ea7c34a87eea3a8333e0da20cabd4d27c97ea26a9e105adf039c2dcdc3ae06d68fe35f291d5f4

Score

10^/10

icedid 2606458729 banker loader trojan

Malware Config

Extracted

Family

icedid

Botnet

2606458729

C2

ruwedolki.pw

2014connflikki.pw

Attributes

auth_var
1
url_path
/audio/

Extracted

Family

icedid

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1272-55-0x0000000000AE0000-0x0000000000AE6000-memory.dmp	IcedidSecondLoader
behavioral1/memory/1272-56-0x0000000000AE0000-0x0000000000D4B000-memory.dmp	IcedidSecondLoader

C:\Users\Admin\AppData\Local\Temp\77a403ad73f8f6b4dd09f90d1aa10f7f205e86ff2e14cacc0afb7d8a6ef98dfe.exe
"C:\Users\Admin\AppData\Local\Temp\77a403ad73f8f6b4dd09f90d1aa10f7f205e86ff2e14cacc0afb7d8a6ef98dfe.exe"
1⤵
PID:1272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-54-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1272-55-0x0000000000AE0000-0x0000000000AE6000-memory.dmp

Filesize
24KB

Download
memory/1272-56-0x0000000000AE0000-0x0000000000D4B000-memory.dmp

Filesize
2.4MB

Download