icedid | 4e1ed4145614b34b4287e18eea2a009180988e418c3314624d741b43e57bfa0a

Analysis

max time kernel
150s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2023 18:35

Target

Docs_Inv_April_11_197.exe
Size

129KB
MD5

9fb1016451f4ea2e4ef5e79e6561200e
SHA1

1616cf0d1e9364c612321bedb797ed331a581b35
SHA256

4e1ed4145614b34b4287e18eea2a009180988e418c3314624d741b43e57bfa0a
SHA512

3f600454f837bd09e859a655239ba5fc492b77946d4056072202c4630348b81e669bde5ba13cacf819a29c37b22b70f8cd42a611b0db9919e7a4e6e1846e2bd1
SSDEEP

1536:J3V4MpcYHJqCG4uuDzCLNgLU18bNzeNbwnApqzPO3I12TMe4vaMzPzUKUvMWHnT7:T4MrqCGxGzsUYNgG4kj4va2UiPJF/Vq

Score

10^/10

Family

icedid

Campaign

1401071739

shoterqana.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Docs_Inv_April_11_197.exe

pid process

1200 Docs_Inv_April_11_197.exe
1200 Docs_Inv_April_11_197.exe

pid	process
1200	Docs_Inv_April_11_197.exe
1200	Docs_Inv_April_11_197.exe

C:\Users\Admin\AppData\Local\Temp\Docs_Inv_April_11_197.exe
"C:\Users\Admin\AppData\Local\Temp\Docs_Inv_April_11_197.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1200

memory/1200-133-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1200-136-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1200-143-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1200-144-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download