icedid | bd2ed2528b1812edeac519c88a07c9db26f1b24e2467889de9e7d69dc23638b6 | Triage

Analysis

max time kernel
122s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2023 00:04

Sharing

Report Analysis Logs

General

Target

Setup_Win_25-01-2023_16-25-55.exe
Size

700.2MB
MD5

ca426dfd3acc18aafff4ab021c1f9acb
SHA1

88be611b943a31a32b16850bb5e4c03c430ede83
SHA256

186893b21a88925cda0729ac405eb95f59ef26608b9fa27a38fcb4dcf5ff3140
SHA512

2b070e298528ecf835d8a2dc0e55fbf84aabb061ac621a1efa8f722b1a7a44354867dcb3075af7874bd4695c6625bfb52ccae2923332c33c3c7c459e04031159
SSDEEP

6144:vEwzu35pbRYlB/DZxT+O3whxYVcLX+xf8OB3hceNl:fzmolB/rTx3whxYOPWv

Score

10^/10

icedid 1392658338 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1392658338

C2

nrncipalmoonw.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setup_Win_25-01-2023_16-25-55.exe

pid process

4184 Setup_Win_25-01-2023_16-25-55.exe
4184 Setup_Win_25-01-2023_16-25-55.exe

C:\Users\Admin\AppData\Local\Temp\Setup_Win_25-01-2023_16-25-55.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_Win_25-01-2023_16-25-55.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4184-132-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download