icedid | fb188c80159174b092bc8ca3b0721b3550ad5943a999f79fd904e2dac19d9c07

Analysis

max time kernel
145s
max time network
205s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22-11-2022 07:35

Target

fb188c80159174b092bc8ca3b0721b3550ad5943a999f79fd904e2dac19d9c07.exe
Size

640KB
MD5

1e7f6aae82bb4d32a5d9edfc23647c89
SHA1

f9e9d40080329f86cba154dac3b3f7c135a9714d
SHA256

fb188c80159174b092bc8ca3b0721b3550ad5943a999f79fd904e2dac19d9c07
SHA512

bec1a939bc35bcb36c70a1d044c894b3a467e8076672889ee206a2a09dca7bf1941b715774da297cb933f8c42e6c4068c995279fc09b0a2b80ab4755b3519247
SSDEEP

12288:I5CfGwrAL0gfc2ifWWERzk3+BxMngu1/mbN37i:5fGwrAL0Uc2IWWERzk3+BxMng+0Zi

Score

10^/10

Family

icedid

Campaign

3663790369

alconauytor.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

fb188c80159174b092bc8ca3b0721b3550ad5943a999f79fd904e2dac19d9c07.exe

pid	process
1488	fb188c80159174b092bc8ca3b0721b3550ad5943a999f79fd904e2dac19d9c07.exe
1488	fb188c80159174b092bc8ca3b0721b3550ad5943a999f79fd904e2dac19d9c07.exe

C:\Users\Admin\AppData\Local\Temp\fb188c80159174b092bc8ca3b0721b3550ad5943a999f79fd904e2dac19d9c07.exe
"C:\Users\Admin\AppData\Local\Temp\fb188c80159174b092bc8ca3b0721b3550ad5943a999f79fd904e2dac19d9c07.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1488

memory/1488-54-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1488-60-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download