icedid | ba0743df409f0176c11637524ea85cda7da7d0e36d5f2b0c7614c2d70f0a533a

Analysis

max time kernel
122s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2023 17:26

Target

Setup_Win_24-01-2023_17-01-50.exe
Size

700.3MB
MD5

6908aa1c9f661ffd4d904a7bc1505c74
SHA1

730843fad7880562e63580d312294c14cbb66f78
SHA256

e4623bb4e1a8f69af039fcb3d30a24cad0ff7822b1189a7fe9b0da74f26f226c
SHA512

68ee90517b09b1826adb5cd7363d29b9332c426b9626aecf0fdc75b5f39597810d195668afc2abc07b5abf36326146ff1efd6f1e08c54dfb18f54eefe12eba06
SSDEEP

6144:CAHUFNIhsCZaNuaG8Hya5EDZObAnvx7LzKJk3Y1e5KRXmQzFtYVMN:3UFUvxaZnaD7+JZCy

Score

10^/10

Family

icedid

Campaign

3324185820

druidfenixis.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setup_Win_24-01-2023_17-01-50.exe

pid process

5000 Setup_Win_24-01-2023_17-01-50.exe
5000 Setup_Win_24-01-2023_17-01-50.exe

pid	process
5000	Setup_Win_24-01-2023_17-01-50.exe
5000	Setup_Win_24-01-2023_17-01-50.exe

C:\Users\Admin\AppData\Local\Temp\Setup_Win_24-01-2023_17-01-50.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_Win_24-01-2023_17-01-50.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5000

memory/5000-132-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download