icedid | 1c59249cdf921be0b26fd5fd64874f38d63bcbc9cdc5b17967db455e25272d6e | Triage

Analysis

max time kernel
183s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-05-2022 00:02

Sharing

Report Analysis Logs

General

Target

1c59249cdf921be0b26fd5fd64874f38d63bcbc9cdc5b17967db455e25272d6e.exe
Size

304KB
MD5

9dd07a974beabc119755f1e4dfc7202a
SHA1

64b543b906bc355f5e08d6a878097ed0a7a09fb5
SHA256

1c59249cdf921be0b26fd5fd64874f38d63bcbc9cdc5b17967db455e25272d6e
SHA512

c97508a92f7b60586d61af9b48847998d2bdc92be5e1864a75b07afce5c8dddb7aca2aabf04798e6508009c41352bed21dbe5b98e37ade84eb76eb13a5322221

Score

10^/10

icedid 3266946033 banker loader trojan

Malware Config

Extracted

Family

icedid

Extracted

Family

icedid

Botnet

3266946033

C2

headcaliber.top

destroycruiser.cyou

Attributes

auth_var
1
url_path
/audio/

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4796-130-0x0000000000760000-0x00000000008A8000-memory.dmp	IcedidSecondLoader
behavioral2/memory/4796-131-0x0000000000760000-0x0000000000766000-memory.dmp	IcedidSecondLoader

C:\Users\Admin\AppData\Local\Temp\1c59249cdf921be0b26fd5fd64874f38d63bcbc9cdc5b17967db455e25272d6e.exe
"C:\Users\Admin\AppData\Local\Temp\1c59249cdf921be0b26fd5fd64874f38d63bcbc9cdc5b17967db455e25272d6e.exe"
1⤵
PID:4796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4796-130-0x0000000000760000-0x00000000008A8000-memory.dmp

Filesize
1.3MB

Download
memory/4796-131-0x0000000000760000-0x0000000000766000-memory.dmp

Filesize
24KB

Download