icedid | 66929d5e456695078946cfea55ff20936fd28eb43c07864bd4f0768723569806

Analysis

max time kernel
302s
max time network
309s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2023 17:49

Target

Setup_Win_24-01-2023_17-31-13.exe
Size

700.3MB
MD5

0b799cb76106cb6a5eb20e29d3d04aa0
SHA1

c241d4dd5bdf5ac1c2ee7d5057a5661729a33234
SHA256

61de19c8fa58840e99c645e42ac689a4e9d6288d90c2f172ecba4dbf0592a070
SHA512

d12b43aff894786f361742685fd70e6113f4fa1d3ad5680742622d4b6864889ff2df25a36c0871816126289f2e7b2705c7c0f6a75438087f0676acdbbdff2bda
SSDEEP

6144:7AHUFNIhsCZaNuaG8Hya5EDZObAnvx7LzKJk3Y1e5KRXmQzFtYVQQb:UUFUvxaZnaD7+JZCl

Score

10^/10

Family

icedid

Campaign

3324185820

druidfenixis.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setup_Win_24-01-2023_17-31-13.exe

pid process

4856 Setup_Win_24-01-2023_17-31-13.exe
4856 Setup_Win_24-01-2023_17-31-13.exe

pid	process
4856	Setup_Win_24-01-2023_17-31-13.exe
4856	Setup_Win_24-01-2023_17-31-13.exe

C:\Users\Admin\AppData\Local\Temp\Setup_Win_24-01-2023_17-31-13.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_Win_24-01-2023_17-31-13.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4856

memory/4856-132-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download