icedid | 3278d5d944d0773e22cda20c978ee86c6185a28f5a93facd0f3732a5ddc755d8

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
08/08/2023, 02:11

Target
4a862a6538e1812d1969572f922c630c.exe
Size 785KB
Sample230808-cl9wdsbf81
SHA256 3278d5d944d0773e22cda20c978ee86c6185a28f5a93facd0f3732a5ddc755d8
MD5 4a862a6538e1812d1969572f922c630c
SHA1 774e6ec451eb29f2b29699d8dc718fb69ff7ad0e
SHA512 5b9fec441456303b73524ed50bf0aa393d26d0f46362118fbb27c635bbce99af593b189fd16baea03fa60045ff7371b66606c266e37c390cdb4b227f6bdc7b2d
SSDEEP 12288:EFsCfLXwG5W8M5XiXRY9IszLRMyCErDc/yStGgRh6bF4h/T7Sui9k5m:EFsCjXwqU5yS9IszmK4/DawQcm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2640	4a862a6538e1812d1969572f922c630c.exe
2640	4a862a6538e1812d1969572f922c630c.exe

C:\Users\Admin\AppData\Local\Temp\4a862a6538e1812d1969572f922c630c.exe
"C:\Users\Admin\AppData\Local\Temp\4a862a6538e1812d1969572f922c630c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2640

memory/2640-55-0x00000000000D0000-0x0000000000138000-memory.dmp

Download

memory/2640-54-0x0000000000020000-0x0000000000028000-memory.dmp

Download