icedid | fc42f12b74a106b724ed9772b308f2ca310a0f415d63da3d19b5861e63ee252f

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/05/2023, 09:59

Target
fc42f12b74a106b724ed9772b308f2ca310a0f415d63da3d19b5861e63ee252f.exe
Size 605KB
Sample230514-lz5chadh5v
SHA256 fc42f12b74a106b724ed9772b308f2ca310a0f415d63da3d19b5861e63ee252f
MD5 280b292fd7a0aeebeabff3bd9db8fe98
SHA1 60d2ff91c4fd80ec83d36b3ee0c32b08684a943d
SHA512 677808ff61d749577556949fd519dc3ba04e65d9887e01cbd9cdb0265dbfb3b68ea5821b0f9fef5613ac44818a715eddbab5d63b387a2ec64da463eec04cce7c
SSDEEP 12288:hCkJqZecIyU6L7EvzjRObLni3ZSEGSxzltIZCdA5+KaG:hCkJQecG6L7EnKipsQltIL8G
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1592	fc42f12b74a106b724ed9772b308f2ca310a0f415d63da3d19b5861e63ee252f.exe
1592	fc42f12b74a106b724ed9772b308f2ca310a0f415d63da3d19b5861e63ee252f.exe

C:\Users\Admin\AppData\Local\Temp\fc42f12b74a106b724ed9772b308f2ca310a0f415d63da3d19b5861e63ee252f.exe
"C:\Users\Admin\AppData\Local\Temp\fc42f12b74a106b724ed9772b308f2ca310a0f415d63da3d19b5861e63ee252f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1592

memory/1592-54-0x0000000000020000-0x0000000000028000-memory.dmp

Download

memory/1592-55-0x00000000001D0000-0x0000000000205000-memory.dmp

Download