icedid | 3a372f27b78697e37089df89b21d82b804ed0d8005388eaeac77bd87eb83ac76

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-11-2024 10:41

Target

4640be3b45d5600049276a5a5d57bfd880d224d3628edbc16716f17abb6383aa.exe
Size

605KB
MD5

004ddd044033d43da09ed712172050ae
SHA1

06c7386fdc09b49d015e6b80040366bcd79f9064
SHA256

4640be3b45d5600049276a5a5d57bfd880d224d3628edbc16716f17abb6383aa
SHA512

6d3ccf61a233eac2edd99fe2f661ddbc4b8014cafb55d8bd1a01c6ae8af76441e3b92f46f3e1ad2ddcff9026419569f6e2507e38d830bd6120174a1fde7f68f5
SSDEEP

12288:/T6pHPYXMRfXSVGVb8meK1+clygE6YSUCNOio+iI7xM1:b6pPAMtXSVGlGnCFo+1Q

Score

10^/10

Family

icedid

Campaign

997059431

gintoonafa.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2604	4640be3b45d5600049276a5a5d57bfd880d224d3628edbc16716f17abb6383aa.exe
2604	4640be3b45d5600049276a5a5d57bfd880d224d3628edbc16716f17abb6383aa.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2928	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2928	AUDIODG.EXE
Token: 33	2928	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2928	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\4640be3b45d5600049276a5a5d57bfd880d224d3628edbc16716f17abb6383aa.exe
"C:\Users\Admin\AppData\Local\Temp\4640be3b45d5600049276a5a5d57bfd880d224d3628edbc16716f17abb6383aa.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2604

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2928

memory/2604-0-0x00000000000C0000-0x00000000000F5000-memory.dmp

Filesize
212KB

Download
memory/2604-1-0x0000000000020000-0x0000000000028000-memory.dmp

Filesize
32KB

Download
memory/2604-2-0x00000000000C0000-0x00000000000F5000-memory.dmp

Filesize
212KB

Download