icedid | 3526e3589a72bed8dc1a1aea9187fa8c1ef195cb4909a1a14ece4206a789a395 | Triage

Analysis

max time kernel
152s
max time network
186s
platform
windows7_x64
resource
win7-20220414-en
submitted
12-05-2022 00:02

Sharing

Report Analysis Logs

General

Target

3526e3589a72bed8dc1a1aea9187fa8c1ef195cb4909a1a14ece4206a789a395.exe
Size

304KB
MD5

c080ff7aa3792c34b957f40be2920bbf
SHA1

b9af14b39f99f8cbaa4edad1c6b409811592b646
SHA256

3526e3589a72bed8dc1a1aea9187fa8c1ef195cb4909a1a14ece4206a789a395
SHA512

d6a12283b949c4d1a565ac4cd0a07f570edf3e60c931a866b7519a7afa9cc54071cd12f551cf02c50a3b1f06abe9ebf6249fd29a662ec626b2845064b6b43165

Score

10^/10

icedid 3266946033 banker loader trojan

Malware Config

Extracted

Family

icedid

Botnet

3266946033

C2

headcaliber.top

destroycruiser.cyou

Attributes

auth_var
1
url_path
/audio/

Extracted

Family

icedid

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1884-55-0x0000000000820000-0x0000000000826000-memory.dmp	IcedidSecondLoader
behavioral1/memory/1884-56-0x0000000000820000-0x0000000000968000-memory.dmp	IcedidSecondLoader

C:\Users\Admin\AppData\Local\Temp\3526e3589a72bed8dc1a1aea9187fa8c1ef195cb4909a1a14ece4206a789a395.exe
"C:\Users\Admin\AppData\Local\Temp\3526e3589a72bed8dc1a1aea9187fa8c1ef195cb4909a1a14ece4206a789a395.exe"
1⤵
PID:1884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1884-54-0x00000000754A1000-0x00000000754A3000-memory.dmp

Filesize
8KB

Download
memory/1884-55-0x0000000000820000-0x0000000000826000-memory.dmp

Filesize
24KB

Download
memory/1884-56-0x0000000000820000-0x0000000000968000-memory.dmp

Filesize
1.3MB

Download