Analysis

  • max time kernel
    64s
  • max time network
    73s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    14-02-2023 10:21

General

  • Target

    Setup_Win_13-02-2023_16-33-14.exe

  • Size

    708MB

  • MD5

    7327fb493431fa390203c6003bd0512f

  • SHA1

    1b2da3d17e88dba864a53350a0e24e9e96458a2e

  • SHA256

    68fcd0ef08f5710071023f45dfcbbd2f03fe02295156b4cbe711e26b38e21c00

  • SHA512

    fb5783494535b3b99ea1ceec071723334a3a4166ea566912fb01fd33df54ffd6c8777a53a43e3209a8c46830cf8ded274a4675fab4d6c56d64431a0bd0916590

  • SSDEEP

    3072:nbRlETFNpVR3utDFr0IiYimbUAEG6aOyYYNqGHY7MZa2LaE60:bCdei1aUA16ajKMz

Malware Config

Extracted

Family

icedid

Campaign

2076641214

C2

alishabrindeader.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup_Win_13-02-2023_16-33-14.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup_Win_13-02-2023_16-33-14.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/892-54-0x0000000140000000-0x0000000140008000-memory.dmp
    Filesize

    32KB

  • memory/892-60-0x0000000000400000-0x0000000001400000-memory.dmp
    Filesize

    16MB