icedid | 4932b4ec3237f464b6e29179dfa43adc0740d520cd115657d01d122010274e95

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2023 17:08

Target

Setup_Win_24-01-2023_16-34-32.exe
Size

700.3MB
MD5

25bc6cd71eb39d9cc093a371e5ff73c6
SHA1

b2a97ac341732b83a073b1e02e7e57eab136b2b5
SHA256

c483b19c7700538210dffaa2d94c4076bca26725b52aeea07062472ec2508be9
SHA512

deb16ceedd95b27bf3062a95d35b19dc505619a3784a2785bd312aff451927ceaf1c82833ff0eccd96462b38503da8f5f69d4ce8e96410045963346e6fd53ab1
SSDEEP

6144:bAHUFNIhsCZaNuaG8Hya5EDZObAnvx7LzKJk3Y1e5KRXmQzFtYVKv:0UFUvxaZnaD7+JZCm

Score

10^/10

Family

icedid

Campaign

3324185820

druidfenixis.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setup_Win_24-01-2023_16-34-32.exe

pid process

1284 Setup_Win_24-01-2023_16-34-32.exe
1284 Setup_Win_24-01-2023_16-34-32.exe

pid	process
1284	Setup_Win_24-01-2023_16-34-32.exe
1284	Setup_Win_24-01-2023_16-34-32.exe

C:\Users\Admin\AppData\Local\Temp\Setup_Win_24-01-2023_16-34-32.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_Win_24-01-2023_16-34-32.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1284

memory/1284-132-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download