icedid | 753a41ddc820066bea09e4eed3daf18d42710dda0f2f3fc06d3ec494e4056caa

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2023, 16:17

Target
Scan_Doc_07-26(144).exe
Size 466KB
Sample230726-trcxaaec87
SHA256 753a41ddc820066bea09e4eed3daf18d42710dda0f2f3fc06d3ec494e4056caa
MD5 50adef995a977c8907db0f5f3c7263c5
SHA1 b5778ad6d81193c0d088d961d096cc58326fffeb
SHA512 272d585d77a4ae6de8e2f563380d0360a076cafc7edf25a43327ae7d8bd73eaee5d1004d28ebeb5901280a049aacc07a50283851fd88af4b7e4de398a00142eb
SSDEEP 12288:uDvQIWv+AVQG1Fa3P+iy3Gp3gPAjY2ksi9B3izi3:Qvr+7F1Fa3P+DojYsaB3J3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4680	Scan_Doc_07-26(144).exe
4680	Scan_Doc_07-26(144).exe

C:\Users\Admin\AppData\Local\Temp\Scan_Doc_07-26(144).exe
"C:\Users\Admin\AppData\Local\Temp\Scan_Doc_07-26(144).exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4680

memory/4680-133-0x00000284C62A0000-0x00000284C62DC000-memory.dmp

Download

memory/4680-134-0x00000284C6000000-0x00000284C6008000-memory.dmp

Download