icedid | 96849c71c8d88d020bb2fdb44faf3c8a4e1c9a6e2c1126016757ef73807f78b9

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 12:20

Target

96849c71c8d88d020bb2fdb44faf3c8a4e1c9a6e2c1126016757ef73807f78b9.exe
Size

560KB
MD5

d997fb33d0ad2cc1ddf6214af84d4a2a
SHA1

175026fc7ba8c7b0566264723561cca250f48f07
SHA256

96849c71c8d88d020bb2fdb44faf3c8a4e1c9a6e2c1126016757ef73807f78b9
SHA512

ff414cbdbe82594d599ca487f9ddba98593270d98dd2a4eee4c0f8703200be08264d17a77836ab4421a5f0614a06ac97b66bb00bd4ecca6df0ed6abf2fc9e45a
SSDEEP

6144:AQJt0hn3E6U3DHpwKyLmKyLmKyL36cYV6b4/O47KkOPowb9wZTR:Du1spwkk9UVT7twRaV

Score

10^/10

Family

icedid

Campaign

181658900

asiksliopakt.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

96849c71c8d88d020bb2fdb44faf3c8a4e1c9a6e2c1126016757ef73807f78b9.exe

pid	process
1904	96849c71c8d88d020bb2fdb44faf3c8a4e1c9a6e2c1126016757ef73807f78b9.exe
1904	96849c71c8d88d020bb2fdb44faf3c8a4e1c9a6e2c1126016757ef73807f78b9.exe

C:\Users\Admin\AppData\Local\Temp\96849c71c8d88d020bb2fdb44faf3c8a4e1c9a6e2c1126016757ef73807f78b9.exe
"C:\Users\Admin\AppData\Local\Temp\96849c71c8d88d020bb2fdb44faf3c8a4e1c9a6e2c1126016757ef73807f78b9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1904

memory/1904-132-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1904-138-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download