icedid | 395615f7064993715dae6e0aba8dc87e307d2bc342b58de53af3881174032ebc | Triage

Analysis

max time kernel
155s
max time network
171s
platform
windows10_x64
resource
win10-20220223-en
submitted
16-03-2022 09:53

Sharing

Report Analysis Logs

General

Target

395615f7064993715dae6e0aba8dc87e307d2bc342b58de53af3881174032ebc.exe
Size

182KB
MD5

e1d37315e61fea96c175225c10bfd92f
SHA1

f552e20ada60023d2e3cfa4ebbc24cd2e9a40fe3
SHA256

395615f7064993715dae6e0aba8dc87e307d2bc342b58de53af3881174032ebc
SHA512

8b010bebfdcc0d9cdeeae3a9239f1bc42f58d5981943d18db7c803a87fc7bbc66519e80c8b12e3dd49429a255a0052411f0250048d85e89375141c9bdd35cff9

Score

10^/10

icedid 340314286 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

340314286

C2

overpasta.ink

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

395615f7064993715dae6e0aba8dc87e307d2bc342b58de53af3881174032ebc.exe

pid	process
3964	395615f7064993715dae6e0aba8dc87e307d2bc342b58de53af3881174032ebc.exe
3964	395615f7064993715dae6e0aba8dc87e307d2bc342b58de53af3881174032ebc.exe

C:\Users\Admin\AppData\Local\Temp\395615f7064993715dae6e0aba8dc87e307d2bc342b58de53af3881174032ebc.exe
"C:\Users\Admin\AppData\Local\Temp\395615f7064993715dae6e0aba8dc87e307d2bc342b58de53af3881174032ebc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3964-114-0x00007FF7CF6F0000-0x00007FF7CF6F9000-memory.dmp

Filesize
36KB

Download