icedid | 5f42123ef4fc37ff4851a8f585c94ebc1abf0c02e3cc62cba7835497cbe55c8d | Triage

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20220414-en
submitted
10-05-2022 18:59

Sharing

Report Analysis Logs

General

Target

5f42123ef4fc37ff4851a8f585c94ebc1abf0c02e3cc62cba7835497cbe55c8d.exe
Size

304KB
MD5

ae3b51bf4e30354ce395943fa296bb5b
SHA1

6ddaf35f73afbee03cb45192d146c10ecfbe3d35
SHA256

5f42123ef4fc37ff4851a8f585c94ebc1abf0c02e3cc62cba7835497cbe55c8d
SHA512

0a46bf03cea6b79bb7a718139fdb2b1071697a5c3f31ca1c000c6ec78e54174eeba778383c2bdfc503723c4794310782a54ee7d3b3a03865cda41f6e9d6ecf4f

Score

10^/10

icedid 3266946033 banker loader trojan

Malware Config

Extracted

Family

icedid

Botnet

3266946033

C2

headcaliber.top

destroycruiser.cyou

Attributes

auth_var
1
url_path
/audio/

Extracted

Family

icedid

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1864-55-0x0000000000D50000-0x0000000000D56000-memory.dmp	IcedidSecondLoader
behavioral1/memory/1864-56-0x0000000000D50000-0x0000000000E98000-memory.dmp	IcedidSecondLoader

C:\Users\Admin\AppData\Local\Temp\5f42123ef4fc37ff4851a8f585c94ebc1abf0c02e3cc62cba7835497cbe55c8d.exe
"C:\Users\Admin\AppData\Local\Temp\5f42123ef4fc37ff4851a8f585c94ebc1abf0c02e3cc62cba7835497cbe55c8d.exe"
1⤵
PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1864-55-0x0000000000D50000-0x0000000000D56000-memory.dmp

Filesize
24KB

Download
memory/1864-56-0x0000000000D50000-0x0000000000E98000-memory.dmp

Filesize
1.3MB

Download