icedid | e02483eca255879ba6a57365dbecb56f5049283d8cd3f030dceca5c69f7af161

Resubmissions

21-01-2021 15:28

19-11-2020 05:39

Target

WSGaRIW.dll
Size

140KB
MD5

4fbee1cbb17b4a05ae5b5431a76087fb
SHA1

44ffaa43eb2bba71325d406703ad82e010376cac
SHA256

e02483eca255879ba6a57365dbecb56f5049283d8cd3f030dceca5c69f7af161
SHA512

f1c0cf3e5f00e63d8edcb1cf171fde79b72945ab0d9bdd8a4ecb84b3a2b37d08eec0a59926b10a6cfaa97409a5bcb372805d09aab5e9248cde85bcb5b83fec93

Score

10^/10

Family

icedid

klopperflitter.cyou

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1996 created 612	1996	WerFault.exe	69

IcedID First Stage Loader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/612-3-0x0000000010000000-0x0000000010006000-memory.dmp	IcedidFirstLoader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1996	612	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 612	728	rundll32.exe	69
PID 728 wrote to memory of 612	728	rundll32.exe	69
PID 728 wrote to memory of 612	728	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WSGaRIW.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WSGaRIW.dll,#1
  2⤵
  PID:612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 656
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1996

memory/612-3-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/612-4-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/1996-5-0x0000000004590000-0x0000000004591000-memory.dmp

Filesize
4KB

Download