icedid | a2a9ecf82d0ab335d901f5d7e4f085c4d03692e5eadb52d0ac5843d387204fe0 | Triage

Analysis

max time kernel
14s
max time network
123s
platform
windows10_x64
resource
win10v20210410
submitted
03-06-2021 13:43

Sharing

Report Analysis Logs

General

Target

a2a9ecf82d0ab335d901f5d7e4f085c4d03692e5eadb52d0ac5843d387204fe0.dll
Size

429KB
MD5

cd88c540b4c5aa55947cf474e8e433af
SHA1

47bb790cecf426f51bb6111a8370f086ce9d94da
SHA256

a2a9ecf82d0ab335d901f5d7e4f085c4d03692e5eadb52d0ac5843d387204fe0
SHA512

4b82835e2ab7f2661e0509c9c99eb2cd2cf9bc7af7c4620e32e5e117d78cd91a56ef4e5a1cac1f7f80caa937cfb0596c8108ba1a9c92ca82356aec5f2811c287

Score

10^/10

icedid 548569227 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

548569227

C2

buzzinmaster.live

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 852 created 1808 852 WerFault.exe regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

852 1808 WerFault.exe regsvr32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 852 WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a2a9ecf82d0ab335d901f5d7e4f085c4d03692e5eadb52d0ac5843d387204fe0.dll
1⤵
PID:1808

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1808 -s 496
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:852

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-114-0x0000000000AA0000-0x0000000000AA7000-memory.dmp

Filesize
28KB

Download