S0483: IcedID

S0483: IcedID describes [IcedID](https://attack.mitre.org/software/S0483) is a modular banking malware designed to steal financial information that has been observed in the wild since at least 2017. [IcedID](https://attack.mitre.org/software/S0483) has been downloaded by [Emotet](https://attack.mitre.org/software/S0367) in multiple campaigns.(Citation: IBM IcedID November 2017)(Citation: Juniper IcedID June 2020)

Executive priority

S0483: IcedID is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0483: IcedID by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S0483: IcedID appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

IcedID

IcedID is a modular banking malware designed to steal financial information that has been observed in the wild since at least 2017. IcedID has been downloaded by Emotet in multiple campaigns.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques31 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1497	Virtualization/Sandbox Evasion	IcedID has manipulated Keitaro Traffic Direction System to filter researcher and sandbox traffic.CitationTrendmicro_IcedID
Enterprise	T1055.012	Process HollowingSub-technique	IcedID can inject a Cobalt Strike beacon into cmd.exe via process hallowing.CitationDFIR_Quantum_Ransomware
Enterprise	T1614.001	System Language DiscoverySub-technique	IcedID used the following command to check the country/language of the active console: ` cmd.exe /c chcp >&2`.CitationDFIR_Quantum_Ransomware
Enterprise	T1482	Domain Trust Discovery	IcedID used Nltest during initial discovery.CitationDFIR_Sodinokibi_RansomwareCitationDFIR_Quantum_Ransomware
Enterprise	T1218.007	MsiexecSub-technique	IcedID can inject itself into a suspended msiexec.exe process to send beacons to C2 while appearing as a normal msi application. [2] IcedID has also used msiexec.exe to deploy the IcedID loader.CitationTrendmicro_IcedID
Enterprise	T1189	Drive-by Compromise	IcedID has cloned legitimate websites/applications to distribute the malware.CitationTrendmicro_IcedID
Enterprise	T1048.002	Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolSub-technique	IcedID has exfiltrated collected data via HTTPS.CitationDFIR_Sodinokibi_Ransomware
Enterprise	T1069	Permission Groups Discovery	IcedID has the ability to identify Workgroup membership.[1]
Enterprise	T1053.005	Scheduled TaskSub-technique	IcedID has created a scheduled task to establish persistence.[2]CitationDFIR_Quantum_RansomwareCitationDFIR_Sodinokibi_Ransomware
Enterprise	T1218.011	Rundll32Sub-technique	IcedID has used rundll32.exe to execute the IcedID loader.CitationTrendmicro_IcedIDCitationDFIR_Quantum_Ransomware
Enterprise	T1036.005	Match Legitimate Resource Name or LocationSub-technique	IcedID has modified legitimate .dll files to include malicious code.CitationTrendmicro_IcedID
Enterprise	T1204.002	Malicious FileSub-technique	IcedID has been executed through Word and Excel files with malicious embedded macros and through ISO and LNK files that execute the malicious DLL.[2]CitationDFIR_Quantum_RansomwareCitationDFIR_Sodinokibi_Ransomware
Enterprise	T1518.001	Security Software DiscoverySub-technique	IcedID can identify AV products on an infected host using the following command: ` WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List`.CitationDFIR_Sodinokibi_RansomwareCitationDFIR_Quantum_Ransomware
Enterprise	T1027.009	Embedded PayloadsSub-technique	IcedID has embedded malicious functionality in a legitimate DLL file.CitationTrendmicro_IcedID
Enterprise	T1027.013	Encrypted/Encoded FileSub-technique	IcedID has utilzed encrypted binaries and base64 encoded strings.[2]
Enterprise	T1106	Native API	IcedID has called `ZwWriteVirtualMemory`, `ZwProtectVirtualMemory`, `ZwQueueApcThread`, and `NtResumeThread` to inject itself into a remote process.[2]
Enterprise	T1027.003	SteganographySub-technique	IcedID has embedded binaries within RC4 encrypted .png files.[2]
Enterprise	T1087.002	Domain AccountSub-technique	IcedID can query LDAP and can use built-in `net` commands to identify additional users on the network to infect.[1]CitationDFIR_Quantum_Ransomware
Enterprise	T1047	Windows Management Instrumentation	IcedID has used WMI to execute binaries.[2]CitationDFIR_Sodinokibi_Ransomware
Enterprise	T1059.005	Visual BasicSub-technique	IcedID has used obfuscated VBA string expressions.[2]
Enterprise	T1055.004	Asynchronous Procedure CallSub-technique	IcedID has used `ZwQueueApcThread` to inject itself into remote processes.[1]
Enterprise	T1105	Ingress Tool Transfer	IcedID has the ability to download additional modules and a configuration file from C2.[1][2]CitationDFIR_Quantum_RansomwareCitationLatrodectus APR 2024
Enterprise	T1016	System Network Configuration Discovery	IcedID used the `ipconfig /all` command and a batch script to gather network information.CitationDFIR_Quantum_Ransomware
Enterprise	T1566.001	Spearphishing AttachmentSub-technique	IcedID has been delivered via phishing e-mails with malicious attachments.[2]CitationDFIR_Sodinokibi_Ransomware
Enterprise	T1071.001	Web ProtocolsSub-technique	IcedID has used HTTPS in communications with C2.[2]CitationDFIR_Quantum_RansomwareCitationDFIR_Sodinokibi_Ransomware
Enterprise	T1135	Network Share Discovery	IcedID has used the `net view /all` command to show available shares.CitationDFIR_Quantum_Ransomware
Enterprise	T1185	Browser Session Hijacking	IcedID has used web injection attacks to redirect victims to spoofed sites designed to harvest banking and other credentials. IcedID can use a self signed TLS certificate in connection with the spoofed site and simultaneously maintains a live connection with the legitimate site to display the correct URL and certificates in the browser.[1][2]
Enterprise	T1547.001	Registry Run Keys / Startup FolderSub-technique	IcedID has established persistence by creating a Registry run key.[1]
Enterprise	T1027.002	Software PackingSub-technique	IcedID has packed and encrypted its loader module.[2]
Enterprise	T1082	System Information Discovery	IcedID has the ability to identify the computer name and OS version on a compromised host.[1]CitationDFIR_Quantum_Ransomware
Enterprise	T1573.002	Asymmetric CryptographySub-technique	IcedID has used SSL and TLS in communications with C2.[1][2]

Associated objects

Groups, software, and campaigns

G0127: TA551

TA551 is a financially-motivated threat group that has been active since at least 2018. [1] The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns. [2]

G1038: TA578

TA578 is a threat actor that has used contact forms and email to initiate communications with victims and to distribute malware including Latrodectus, IcedID, and Bumblebee.[1][2]

C0037: Water Curupira Pikabot Distribution

Pikabot was distributed in Water Curupira Pikabot Distribution throughout 2023 by an entity linked to BlackBasta ransomware deployment via email attachments. This activity followed the take-down of QakBot, with several technical overlaps and similarities with QakBot, indicating a possible connection. The identified activity led to the deployment of tools such as Cobalt Strike, while coinciding with campaigns delivering DarkGate and IcedID en route to ransomware deployment.[1]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 20.0
Object version: 1.2
Created: Jul 15, 2020, 17:55 UTC (UTC+00:00)
Modified: Apr 22, 2025, 22:16 UTC (UTC+00:00)
Raw hash: 362532594b1e1809...

Imported snapshots across ATT&CK releases(3)

Release	Bundle imported	Object version	Modified	Status	Raw hash
20.0	Oct 18, 2026, 20:39 UTC (UTC+00:00)	1.2	Apr 22, 2025, 22:16 UTC (UTC+00:00)	Current bundle	`362532594b1e…`
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.2	Apr 22, 2025, 22:16 UTC (UTC+00:00)	Older bundle	`362532594b1e…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.2	Apr 22, 2025, 22:16 UTC (UTC+00:00)	Older bundle	`362532594b1e…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
IBM IcedID November 2017
Kessem, L., et al. (2017, November 13). New Banking Trojan IcedID Discovered by IBM X-Force Research. Retrieved July 14, 2020.
Open source URL
[2]
Juniper IcedID June 2020
Kimayong, P. (2020, June 18). COVID-19 and FMLA Campaigns used to install new IcedID banking malware. Retrieved July 14, 2020.
Open source URL
[3]
mitre-attackS0483
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use