icedid | 4d00dd3d606e59496069e836b1c4466d5a11a1a03c2207947f64e4442099657a

Analysis

Target

VSMecyU.dll
Size

131KB
MD5

4f807ffbf0704b3aaf708a1aef892dfd
SHA1

55fb9e7df549ca9133dd2d481930e1042a8c61bc
SHA256

4d00dd3d606e59496069e836b1c4466d5a11a1a03c2207947f64e4442099657a
SHA512

8e7cf9306b690dd5afb762788dbfc88f8e7a54ecc1880c7e1cd80e358b22f2a3624173efd6f2a7c4ce510906876cc639eb261986abb7186365ee038be464a4dc

Score

10^/10

Family

icedid

Campaign

3765533603

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

12 1804 rundll32.exe
14 1804 rundll32.exe
16 1804 rundll32.exe
18 1804 rundll32.exe
20 1804 rundll32.exe
22 1804 rundll32.exe
24 1804 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1804 rundll32.exe
1804 rundll32.exe

pid	process
1804	rundll32.exe
1804	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1400 wrote to memory of 1804	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1804	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1804	1400	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VSMecyU.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VSMecyU.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1804