icedid | c6aafa6b32ac91908ee37207c6feb4cef74aa8e9b82e70c1e58e5691a9319c60

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 12:19

Target

c6aafa6b32ac91908ee37207c6feb4cef74aa8e9b82e70c1e58e5691a9319c60.exe
Size

735KB
MD5

066232e9a5c55c8b3c7cac91de55d747
SHA1

aa52f8ce282c111335b943a7c6b8191a17f99018
SHA256

c6aafa6b32ac91908ee37207c6feb4cef74aa8e9b82e70c1e58e5691a9319c60
SHA512

0da3276e1735d2e5f4008d6a6e3f06238362d9cadef69d7e76e177c7a96297972eae61d2176f12ccf27d1c515461d1ee6342cc303d7564aa593e73447f9cdeb5
SSDEEP

12288:7A09SCX6XZXYnXq4XC6EWpwNkQimxoQDRjL0wzU/1:009SCX6XhWvwhyQRRcwzU/1

Score

10^/10

Family

icedid

Campaign

1930527392

starnaddplenumsak.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c6aafa6b32ac91908ee37207c6feb4cef74aa8e9b82e70c1e58e5691a9319c60.exe

pid	process
3228	c6aafa6b32ac91908ee37207c6feb4cef74aa8e9b82e70c1e58e5691a9319c60.exe
3228	c6aafa6b32ac91908ee37207c6feb4cef74aa8e9b82e70c1e58e5691a9319c60.exe

C:\Users\Admin\AppData\Local\Temp\c6aafa6b32ac91908ee37207c6feb4cef74aa8e9b82e70c1e58e5691a9319c60.exe
"C:\Users\Admin\AppData\Local\Temp\c6aafa6b32ac91908ee37207c6feb4cef74aa8e9b82e70c1e58e5691a9319c60.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3228

memory/3228-132-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/3228-138-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download