IcedID Attackers can Exfiltrate Data Within Two Days After Initial Infection

Once the initial IcedID infection is done, an interactive command line session is started, which downloads additional files on the infected system. Seven minutes after the initial infection, a Cobalt Strike beacon is used on the infected computer.