icedid | 273d966c70659c3b4cae40702ebecb769d1505f5fd6f2aef4cbb1b6e9efdfd40 | Triage

Analysis

max time kernel
149s
max time network
184s
platform
windows7_x64
resource
win7-20220414-en
submitted
16-06-2022 05:32

Sharing

Report Analysis Logs

General

Target

273d966c70659c3b4cae40702ebecb769d1505f5fd6f2aef4cbb1b6e9efdfd40.exe
Size

808KB
MD5

2d67d85e4c57aaa73c437993fcc31c2e
SHA1

74682c5a7517fff45071eacefe1994d4526f91f9
SHA256

273d966c70659c3b4cae40702ebecb769d1505f5fd6f2aef4cbb1b6e9efdfd40
SHA512

8880e9b0705ce9bc99bf33722a5b18b14740b2d96104001fa5d64f7e4e0132f8bfaf5e045e6e997b9c0e5ed344c0d9635c0f0ce447a2c60cd67a8c9c3c7b2ac7

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1700-56-0x0000000000400000-0x00000000004CD000-memory.dmp	IcedidSecondLoader

C:\Users\Admin\AppData\Local\Temp\273d966c70659c3b4cae40702ebecb769d1505f5fd6f2aef4cbb1b6e9efdfd40.exe
"C:\Users\Admin\AppData\Local\Temp\273d966c70659c3b4cae40702ebecb769d1505f5fd6f2aef4cbb1b6e9efdfd40.exe"
1⤵
PID:1700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1700-55-0x00000000003C0000-0x00000000003D5000-memory.dmp

Filesize
84KB

Download
memory/1700-56-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download