icedid | 8355d03ce881e5c5e765e01ab55b7a084208311d94fd160dd197a2ca2783ad48

Analysis

max time kernel
124s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-01-2023 14:54

Target

bd67e49c2ca15156c54956655928723063eca5b4d90ae22dd6ce1029ba596b35.exe
Size

443KB
MD5

823e6ec59140043e4e850e4016018a77
SHA1

f12d6a892debcfeec812108ea8913eb6d09bbdc4
SHA256

bd67e49c2ca15156c54956655928723063eca5b4d90ae22dd6ce1029ba596b35
SHA512

8d4f7b1e1092a62a00f7c34c778694aef36d616c8182df4f77f8ce0e46ffe0eeda14467819d893f1f7c17d36fb9a5d281824933647cae9bbb1bef8a1f5a61e79
SSDEEP

6144:1zzkhbh8r2y6gudO7sBdvkJ5mXWboh4cd1gJkrW4MqR823v1djjJIAOV4Eq:1EhbGjyY7sncGXWbo3d9MqRnjjGAnR

Score

10^/10

Family

icedid

Campaign

3248465841

qsertopinajil.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

bd67e49c2ca15156c54956655928723063eca5b4d90ae22dd6ce1029ba596b35.exe

pid	process
988	bd67e49c2ca15156c54956655928723063eca5b4d90ae22dd6ce1029ba596b35.exe
988	bd67e49c2ca15156c54956655928723063eca5b4d90ae22dd6ce1029ba596b35.exe

C:\Users\Admin\AppData\Local\Temp\bd67e49c2ca15156c54956655928723063eca5b4d90ae22dd6ce1029ba596b35.exe
"C:\Users\Admin\AppData\Local\Temp\bd67e49c2ca15156c54956655928723063eca5b4d90ae22dd6ce1029ba596b35.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:988

memory/988-54-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp

Filesize
8KB

Download
memory/988-55-0x0000000000410000-0x0000000000418000-memory.dmp

Filesize
32KB

Download
memory/988-61-0x0000000140000000-0x0000000140071000-memory.dmp

Filesize
452KB

Download