icedid | f178abf5131c3eaf68a1584c2759d8b29418a8aa5b9f95bfd1def0be2c23c97e

Analysis

max time kernel
128s
max time network
136s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22-01-2023 12:37

Target

Setup_Win_21-01-2023_17-35-38.exe
Size

700.6MB
MD5

a5190aa0a6899a0fe4fe13cf2e78aff3
SHA1

1d645a416d5824188b56ed8eceb9f47e2588bdbb
SHA256

d6ff180ad400b95cce06dc1e9ee54be77cfcacfb01886300c95e6467884c7ecc
SHA512

63286f0e4d3abcd3b9ff5af523e844f4ba701339f27078494123fff4455c346d53939cafe660af70f3e521b1f8f269e881a359fe43ac95770716abf60d20dcf7
SSDEEP

12288:nx4woejwB/MvGWkdRHklpGgKa/XQum4MECSH:x4w9jG/M+WkdRHklpGgKa/XQcH

Score

10^/10

Family

icedid

Campaign

1454132006

umousteraton.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setup_Win_21-01-2023_17-35-38.exe

pid process

1796 Setup_Win_21-01-2023_17-35-38.exe
1796 Setup_Win_21-01-2023_17-35-38.exe

pid	process
1796	Setup_Win_21-01-2023_17-35-38.exe
1796	Setup_Win_21-01-2023_17-35-38.exe

C:\Users\Admin\AppData\Local\Temp\Setup_Win_21-01-2023_17-35-38.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_Win_21-01-2023_17-35-38.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1796

memory/1796-54-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1796-60-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download