icedid | de20ea323222ac331900592127038347f667738030503f924f83aa14d028a09c

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 11:03

Target
86bbd415051b2674b328203dd1a9b004.exe
Size 125KB
Sample240201-m569qadegl
SHA256 de20ea323222ac331900592127038347f667738030503f924f83aa14d028a09c
MD5 86bbd415051b2674b328203dd1a9b004
SHA1 423d245483b8d45ca3a31e50abc3a94a04e2554b
SHA512 cc2a64e7b505bb4824be2bdb3a528f39f2dfd5dba7038befbf56cefdfffacdd3827d65cd4917617936ef15cbe98e5c2dbb27deed076f3abad0bda80f6f96bf9e
SSDEEP 1536:yWL3c+YD8f742wqwkhG5RC09wunkoYqlWziAJ3CIIq4sv5fsWGdI9dlqYnp:l3c+Yoz0qw2gRhH1YqlWf3CEVvoYsYp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5176	86bbd415051b2674b328203dd1a9b004.exe
5176	86bbd415051b2674b328203dd1a9b004.exe

C:\Users\Admin\AppData\Local\Temp\86bbd415051b2674b328203dd1a9b004.exe
"C:\Users\Admin\AppData\Local\Temp\86bbd415051b2674b328203dd1a9b004.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5176

memory/5176-0-0x0000000140000000-0x00000001400B4000-memory.dmp

Download