{
  "family": "icloader",
  "sample_count": 1145,
  "category": "pua",
  "description": "TrojanDownloader:Win32/ICLoader is a highly evasive, specialized payload dropper heavily utilized by initial access brokers to secure a foothold and deploy advanced threats like ransomware or banking trojans.<br><br><b>What is ICLoader?</b><br>For general users, ICLoader provides zero visual indicators of infection. For SOC analysts, an ICLoader detection is a critical alert. It is a 'first-stage' threat designed purely to bypass initial security controls, profile the endpoint's defenses, and securely retrieve the final, destructive payload from a remote Command-and-Control (C2) server.<br><br><b>Infection Vectors & Threat Hunting</b><br>ICLoader is frequently distributed via weaponized macros in phishing emails or dropped by exploit kits (such as RIG). Upon execution, the loader performs extensive anti-analysis checks, querying the registry and running processes to detect virtual machines, sandboxes, or specific EDR agents. If the environment appears clean, ICLoader connects to its C2 (often utilizing compromised WordPress sites or cloud hosting providers) to download an encrypted binary blob. It decrypts this payload in memory and executes it using Process Hollowing, ensuring the final malware never touches the disk.<br><br><b>Forensic Analysis & Impact</b><br>The impact of ICLoader depends entirely on the secondary payload, which is often high-severity ransomware. Incident responders should hunt for EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Memory forensics is absolutely vital; analysts must capture a RAM image to extract the decrypted secondary payload from the hollowed process. Network analysis will reveal encrypted HTTPS traffic to obscure domains immediately following the initial execution.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1105",
    "T1055.012",
    "T1497.001",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint to prevent ICLoader from successfully downloading and executing the secondary ransomware payload.",
    "Capture a live memory image (RAM dump) before powering down the machine to preserve the memory-resident secondary payload for analysis.",
    "Analyze proxy and DNS logs to identify the C2 domains contacted by ICLoader, and block them proactively across the perimeter.",
    "Perform a deep forensic scan to determine if the secondary payload was successfully executed before isolation."
  ],
  "what_to_avoid": [
    "Do not assume the threat is mitigated simply by deleting the initial phishing email; the memory-resident loader may already be active.",
    "Avoid rebooting the machine during triage, as the secondary payload exists only in memory and will be lost, hindering the investigation."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}