icedid | 19b7db1755e444c14ee0ac7c439e78fce09a29772ac5d9456fee873145f1b441 | Triage

Analysis

max time kernel
149s
max time network
157s
platform
windows7_x64
resource
win7-20220414-en
submitted
10-05-2022 18:59

Sharing

Report Analysis Logs

General

Target

19b7db1755e444c14ee0ac7c439e78fce09a29772ac5d9456fee873145f1b441.exe
Size

216KB
MD5

c234119dd7a60c83cee311446605ff57
SHA1

6103a6d76359340a399fc2aa77ab1f62125a8703
SHA256

19b7db1755e444c14ee0ac7c439e78fce09a29772ac5d9456fee873145f1b441
SHA512

05a7de1bd27d28e5da2c8b1933adeb4c66fbebddecfeda9099ef6c6f7f4f1138cdf0863214f3245463cfd6330665b0613cdf8219fbab9b2d49f83e9ad1849ef8

Score

10^/10

icedid 3224177144 banker loader trojan

Malware Config

Extracted

Family

icedid

Botnet

3224177144

C2

hreglikoli.cyou

ironcontra.cyou

Attributes

auth_var
7
url_path
/audio/

Extracted

Family

icedid

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2020-55-0x0000000000D20000-0x0000000000D26000-memory.dmp	IcedidSecondLoader
behavioral1/memory/2020-56-0x0000000000D20000-0x000000000105A000-memory.dmp	IcedidSecondLoader

C:\Users\Admin\AppData\Local\Temp\19b7db1755e444c14ee0ac7c439e78fce09a29772ac5d9456fee873145f1b441.exe
"C:\Users\Admin\AppData\Local\Temp\19b7db1755e444c14ee0ac7c439e78fce09a29772ac5d9456fee873145f1b441.exe"
1⤵
PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-54-0x00000000755C1000-0x00000000755C3000-memory.dmp

Filesize
8KB

Download
memory/2020-55-0x0000000000D20000-0x0000000000D26000-memory.dmp

Filesize
24KB

Download
memory/2020-56-0x0000000000D20000-0x000000000105A000-memory.dmp

Filesize
3.2MB

Download