icedid | 977ddadd00dfc62105fb1bfa45ccbd8dac782a341fcd9b082988ce789c9dfac3

Analysis

max time kernel
121s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 08:03

Target

3a585be7037b0dd24dbc719e8a05d1a1502108bb6e0fea62d6b90980be75a7d9.exe
Size

649KB
MD5

36b89900c9300156d4ba6e19742c7498
SHA1

2c889cf43e2b0e162ddb2ac9567b1ee3507f9f88
SHA256

3a585be7037b0dd24dbc719e8a05d1a1502108bb6e0fea62d6b90980be75a7d9
SHA512

413e556a825d2342d4b0a364116c43953f1aa362193e2c8b98235856be26ccb9763abd89112b38d39fbc1f4020fdd2f95a581b4e26693f1cf245428688e8d2bb
SSDEEP

12288:o41EwgLoMgUh2W2kRSkWzgVz6iW8fPmniuwiC:XEwgL/gUEW2kRSkWzgVz6l0+iuwF

Score

10^/10

Family

icedid

Campaign

133894510

restorahlith.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3a585be7037b0dd24dbc719e8a05d1a1502108bb6e0fea62d6b90980be75a7d9.exe

pid	process
4336	3a585be7037b0dd24dbc719e8a05d1a1502108bb6e0fea62d6b90980be75a7d9.exe
4336	3a585be7037b0dd24dbc719e8a05d1a1502108bb6e0fea62d6b90980be75a7d9.exe

C:\Users\Admin\AppData\Local\Temp\3a585be7037b0dd24dbc719e8a05d1a1502108bb6e0fea62d6b90980be75a7d9.exe
"C:\Users\Admin\AppData\Local\Temp\3a585be7037b0dd24dbc719e8a05d1a1502108bb6e0fea62d6b90980be75a7d9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4336

memory/4336-132-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/4336-133-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4336-139-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download