icedid | ebcfb23a12c1062c13efa578ad310fc44312f43ae199f926357d6cd54dabbf00

Analysis

max time kernel
86s
max time network
89s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-01-2023 14:47

Target

ebcfb23a12c1062c13efa578ad310fc44312f43ae199f926357d6cd54dabbf00.exe
Size

635KB
MD5

890c4af45ddbdff0cef9875947d0336a
SHA1

373d3388fccb978ac8fd281c8a39707578b05101
SHA256

ebcfb23a12c1062c13efa578ad310fc44312f43ae199f926357d6cd54dabbf00
SHA512

fec3fe07053e6d473a424f0fef8ed736732ac9a6680884a19af53733e356cca6a90c42fa169a872e744eca9890aab9474cea4f455ddbccf87d5d422e48b256bb
SSDEEP

6144:aJi9og6DkOhK8qcAwiHNaKL22qU3SGUG0Du40XObmzXCNih:gLhK84wiAKK2aGsT0+bmbd

Score

10^/10

Family

icedid

Campaign

1150969276

broskabrwaf.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ebcfb23a12c1062c13efa578ad310fc44312f43ae199f926357d6cd54dabbf00.exe

pid	process
968	ebcfb23a12c1062c13efa578ad310fc44312f43ae199f926357d6cd54dabbf00.exe
968	ebcfb23a12c1062c13efa578ad310fc44312f43ae199f926357d6cd54dabbf00.exe

C:\Users\Admin\AppData\Local\Temp\ebcfb23a12c1062c13efa578ad310fc44312f43ae199f926357d6cd54dabbf00.exe
"C:\Users\Admin\AppData\Local\Temp\ebcfb23a12c1062c13efa578ad310fc44312f43ae199f926357d6cd54dabbf00.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:968

memory/968-54-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/968-60-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/968-61-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download