icedid | d4c226ac58ba34c454b19f28e37ac582aed1b627426908ab6c3e414eff254d18

Analysis

max time kernel
124s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 17:37

Target

Setup_Win_02-02-2023_17-33-37.exe
Size

703.3MB
MD5

9bf0ad7befc20eb8c8c207794a7ef768
SHA1

d5aa8eb8889b358a2b4e1d5ed66176d78a108e93
SHA256

6a0e07ca3794e210132daa60ddb4adc6d4f313ea5372511e4ad7758b2d528897
SHA512

fbb79e59e1e34cab5374dd586a39952d40b14c7634d1abbf81d79440fcbec8019e84bdf368af1dc04b07178eac3e2be66f8169ecc8e0c02ea695a374bbdfc808
SSDEEP

6144:azXaEsb8gUAWTibyk0Px1ee2k6S94s68dTcEgDAIpiWe97TzGux0siC6pEOEGElW:a29c+P0Z9tm7sdG

Score

10^/10

Family

icedid

Campaign

1398120717

loliapitudet.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setup_Win_02-02-2023_17-33-37.exe

pid process

1428 Setup_Win_02-02-2023_17-33-37.exe
1428 Setup_Win_02-02-2023_17-33-37.exe

pid	process
1428	Setup_Win_02-02-2023_17-33-37.exe
1428	Setup_Win_02-02-2023_17-33-37.exe

C:\Users\Admin\AppData\Local\Temp\Setup_Win_02-02-2023_17-33-37.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_Win_02-02-2023_17-33-37.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1428

memory/1428-132-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1428-138-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1428-139-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1428-140-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download