icedid | b1ef43379c1af0ed2bbc2dd710df65a550b3b80cce1b734438e20c64f1d5a42e

Analysis

max time kernel
151s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2023, 03:31

Target
SetupWin18-01-202317-44-13.exe
Size 431KB
Sample230119-d23bxseb36
SHA256 b1ef43379c1af0ed2bbc2dd710df65a550b3b80cce1b734438e20c64f1d5a42e
MD5 55fabc6b83edfba269d697a7973cb837
SHA1 13ca26df9e0f7fb04596cbf52aa542a54d0a2e10
SHA512 0dda3ef1fce563b892ce56ca9e7f802a8b4d0d6a73f37fb46b8e263c55382a5c2a6309ce7922b49534e00165141965783eb28e222a515a1d54ee0dbd1c2ea612
SSDEEP 6144:1zzkhbh8r2y6gudO7sBdvkJ5mXWboh4cd1gJkrW4MqR823v1djjJIAOVY:1EhbGjyY7sncGXWbo3d9MqRnjjGAH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
660	SetupWin18-01-202317-44-13.exe
660	SetupWin18-01-202317-44-13.exe

C:\Users\Admin\AppData\Local\Temp\SetupWin18-01-202317-44-13.exe
"C:\Users\Admin\AppData\Local\Temp\SetupWin18-01-202317-44-13.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:660

memory/660-132-0x0000000000430000-0x0000000000438000-memory.dmp

Download

memory/660-138-0x0000000140000000-0x0000000140071000-memory.dmp

Download