icedid | f47ca6d0655a09d8cbc1a02e93899f07a2bf090a35baef342bf50e38cbbc5c6e

Analysis

max time kernel
125s
max time network
128s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-01-2023 12:54

Target

f47ca6d0655a09d8cbc1a02e93899f07a2bf090a35baef342bf50e38cbbc5c6e.exe
Size

13KB
MD5

c85386a1101c416dcb625efe76bf02f4
SHA1

fc0bc5203ae81011d869a3d4945310d5b6b58245
SHA256

f47ca6d0655a09d8cbc1a02e93899f07a2bf090a35baef342bf50e38cbbc5c6e
SHA512

8e0fab3775121c80bf2ab19aa0ef6ae44f06040c4a0af45d1250f82253f415dccdf508c20a60c3f43ace773f3b63fefd7ed9b64a1de84f4b050e9568b09d7422
SSDEEP

192:7KbCHpfVTIFyzPDufy2yz7ZBKUFf636yXxjt5PM6E632:7KbCHFHzmy1z1896yhE6E632

Score

10^/10

Family

icedid

Campaign

1454132006

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f47ca6d0655a09d8cbc1a02e93899f07a2bf090a35baef342bf50e38cbbc5c6e.exe

pid	process
980	f47ca6d0655a09d8cbc1a02e93899f07a2bf090a35baef342bf50e38cbbc5c6e.exe
980	f47ca6d0655a09d8cbc1a02e93899f07a2bf090a35baef342bf50e38cbbc5c6e.exe

C:\Users\Admin\AppData\Local\Temp\f47ca6d0655a09d8cbc1a02e93899f07a2bf090a35baef342bf50e38cbbc5c6e.exe
"C:\Users\Admin\AppData\Local\Temp\f47ca6d0655a09d8cbc1a02e93899f07a2bf090a35baef342bf50e38cbbc5c6e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:980