icedid | f5a0450f073d8309d7bb3979a5bb18bc05214bb95e15bc085e961a0c32ad1012 | Triage

Analysis

max time kernel
133s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
30-03-2022 00:46

Sharing

Report Analysis Logs

General

Target

f5a0450f073d8309d7bb3979a5bb18bc05214bb95e15bc085e961a0c32ad1012.exe
Size

21KB
MD5

7cd28ce0ec661acfce5d0c875c116fb1
SHA1

67f91b5805bab51906e3debe271e443f6064f4da
SHA256

f5a0450f073d8309d7bb3979a5bb18bc05214bb95e15bc085e961a0c32ad1012
SHA512

a120ed7fcba578cb7b4ae2082513c9003309a2a32e9da1e8575e80764d63905ae0d3ffa4c569fce1dfa7a387e0a164af75ca88518482a23dadddd788c11a969e

Score

10^/10

icedid 1666752692 banker suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

1666752692

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f5a0450f073d8309d7bb3979a5bb18bc05214bb95e15bc085e961a0c32ad1012.exe

pid	process
2432	f5a0450f073d8309d7bb3979a5bb18bc05214bb95e15bc085e961a0c32ad1012.exe
2432	f5a0450f073d8309d7bb3979a5bb18bc05214bb95e15bc085e961a0c32ad1012.exe

C:\Users\Admin\AppData\Local\Temp\f5a0450f073d8309d7bb3979a5bb18bc05214bb95e15bc085e961a0c32ad1012.exe
"C:\Users\Admin\AppData\Local\Temp\f5a0450f073d8309d7bb3979a5bb18bc05214bb95e15bc085e961a0c32ad1012.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...