icedid | c6aafa6b32ac91908ee37207c6feb4cef74aa8e9b82e70c1e58e5691a9319c60

Analysis

max time kernel
85s
max time network
97s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 12:19

Target
c6aafa6b32ac91908ee37207c6feb4cef74aa8e9b82e70c1e58e5691a9319c60.exe
Size 735KB
Sample221121-pg6pdsdf2y
SHA256 c6aafa6b32ac91908ee37207c6feb4cef74aa8e9b82e70c1e58e5691a9319c60
MD5 066232e9a5c55c8b3c7cac91de55d747
SHA1 aa52f8ce282c111335b943a7c6b8191a17f99018
SHA512 0da3276e1735d2e5f4008d6a6e3f06238362d9cadef69d7e76e177c7a96297972eae61d2176f12ccf27d1c515461d1ee6342cc303d7564aa593e73447f9cdeb5
SSDEEP 12288:7A09SCX6XZXYnXq4XC6EWpwNkQimxoQDRjL0wzU/1:009SCX6XhWvwhyQRRcwzU/1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
896	c6aafa6b32ac91908ee37207c6feb4cef74aa8e9b82e70c1e58e5691a9319c60.exe
896	c6aafa6b32ac91908ee37207c6feb4cef74aa8e9b82e70c1e58e5691a9319c60.exe

C:\Users\Admin\AppData\Local\Temp\c6aafa6b32ac91908ee37207c6feb4cef74aa8e9b82e70c1e58e5691a9319c60.exe
"C:\Users\Admin\AppData\Local\Temp\c6aafa6b32ac91908ee37207c6feb4cef74aa8e9b82e70c1e58e5691a9319c60.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:896

memory/896-54-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/896-60-0x0000000000400000-0x00000000004BC000-memory.dmp

Download