icedid | 2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b

Analysis

max time kernel
123s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 10:05

Target

2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b.exe
Size

169KB
MD5

81fc38de5b6197c4db58eb506037e7cb
SHA1

c2258ab3204e6061d548df202c99aa361242d848
SHA256

2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b
SHA512

4c96e9104e55454e741a13be34a7c5a3afb8d0d17c1924d629acbd487975d88d4435fd46b34649defe2d047ff4c84e06c4a0d0176085c7b5ab4d80eed18b0d9a
SSDEEP

3072:PcP8DY7QvQMXI/zCMAo14+X0cmPfGMdC+htVenbE:0rISTEZRCG6nbE

Score

10^/10

Family

icedid

Campaign

1875681804

enticationmetho.ink

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b.exe

pid	process
3224	2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b.exe
3224	2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b.exe

C:\Users\Admin\AppData\Local\Temp\2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b.exe
"C:\Users\Admin\AppData\Local\Temp\2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3224

memory/3224-0-0x0000000140000000-0x0000000140009000-memory.dmp

Filesize
36KB

Download
memory/3224-1-0x0000000140000000-0x0000000140009000-memory.dmp

Filesize
36KB

Download