icedid | 1c59249cdf921be0b26fd5fd64874f38d63bcbc9cdc5b17967db455e25272d6e | Triage

Analysis

max time kernel
156s
max time network
195s
platform
windows7_x64
resource
win7-20220414-en
submitted
12-05-2022 00:02

Sharing

Report Analysis Logs

General

Target

1c59249cdf921be0b26fd5fd64874f38d63bcbc9cdc5b17967db455e25272d6e.exe
Size

304KB
MD5

9dd07a974beabc119755f1e4dfc7202a
SHA1

64b543b906bc355f5e08d6a878097ed0a7a09fb5
SHA256

1c59249cdf921be0b26fd5fd64874f38d63bcbc9cdc5b17967db455e25272d6e
SHA512

c97508a92f7b60586d61af9b48847998d2bdc92be5e1864a75b07afce5c8dddb7aca2aabf04798e6508009c41352bed21dbe5b98e37ade84eb76eb13a5322221

Score

10^/10

icedid 3266946033 banker loader trojan

Malware Config

Extracted

Family

icedid

Botnet

3266946033

C2

headcaliber.top

destroycruiser.cyou

Attributes

auth_var
1
url_path
/audio/

Extracted

Family

icedid

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1676-55-0x0000000000330000-0x0000000000336000-memory.dmp	IcedidSecondLoader
behavioral1/memory/1676-56-0x0000000000330000-0x0000000000478000-memory.dmp	IcedidSecondLoader

C:\Users\Admin\AppData\Local\Temp\1c59249cdf921be0b26fd5fd64874f38d63bcbc9cdc5b17967db455e25272d6e.exe
"C:\Users\Admin\AppData\Local\Temp\1c59249cdf921be0b26fd5fd64874f38d63bcbc9cdc5b17967db455e25272d6e.exe"
1⤵
PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1676-54-0x0000000075761000-0x0000000075763000-memory.dmp

Filesize
8KB

Download
memory/1676-55-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/1676-56-0x0000000000330000-0x0000000000478000-memory.dmp

Filesize
1.3MB

Download