icedid | 00dfa5ffcc6c024a8c0c8f00a9cf388ead0dd47617dc341dd4df5874b68bd54e

Analysis

max time kernel
125s
max time network
129s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/01/2023, 20:04

Target
Setup_Win_30-01-2023_19-39-33.exe
Size 117KB
Sample230130-ys9d4aeb21
SHA256 00dfa5ffcc6c024a8c0c8f00a9cf388ead0dd47617dc341dd4df5874b68bd54e
MD5 fda906bee815ff6f8dada7406ce1799d
SHA1 acda1f9b3c9b9e66857d04df0540c2224da325a4
SHA512 701ef70e079908e8f0fd774b9b87b88f5dd95e3cd2a7f14d96cce0bef140b5cb372f64cada3795508e602ea3cee88257fac01028d31e11d0f894a765098fa4d0
SSDEEP 3072:gAF33Cr7dGXMgL/66TpaHAL51GLJDtFS09x+:bc7WL98U5O9G
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1976	Setup_Win_30-01-2023_19-39-33.exe
1976	Setup_Win_30-01-2023_19-39-33.exe

C:\Users\Admin\AppData\Local\Temp\Setup_Win_30-01-2023_19-39-33.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_Win_30-01-2023_19-39-33.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1976

memory/1976-54-0x0000000140000000-0x0000000140008000-memory.dmp

Download