icedid | 68fcd0ef08f5710071023f45dfcbbd2f03fe02295156b4cbe711e26b38e21c00

Analysis

max time kernel
319s
max time network
326s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2023 10:21

Target

Setup_Win_13-02-2023_16-33-14.exe
Size

708.3MB
MD5

7327fb493431fa390203c6003bd0512f
SHA1

1b2da3d17e88dba864a53350a0e24e9e96458a2e
SHA256

68fcd0ef08f5710071023f45dfcbbd2f03fe02295156b4cbe711e26b38e21c00
SHA512

fb5783494535b3b99ea1ceec071723334a3a4166ea566912fb01fd33df54ffd6c8777a53a43e3209a8c46830cf8ded274a4675fab4d6c56d64431a0bd0916590
SSDEEP

3072:nbRlETFNpVR3utDFr0IiYimbUAEG6aOyYYNqGHY7MZa2LaE60:bCdei1aUA16ajKMz

Score

10^/10

Family

icedid

Campaign

2076641214

alishabrindeader.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setup_Win_13-02-2023_16-33-14.exe

pid process

808 Setup_Win_13-02-2023_16-33-14.exe
808 Setup_Win_13-02-2023_16-33-14.exe

pid	process
808	Setup_Win_13-02-2023_16-33-14.exe
808	Setup_Win_13-02-2023_16-33-14.exe

C:\Users\Admin\AppData\Local\Temp\Setup_Win_13-02-2023_16-33-14.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_Win_13-02-2023_16-33-14.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:808

memory/808-132-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/808-138-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/808-139-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download