icedid | ff734fe39dbcfde88977691062d0a6c17385424c3dd8b4ddeb475368d2cb7205 | Triage

Analysis

max time kernel
16s
max time network
114s
platform
windows10_x64
resource
win10v20210408
submitted
04-06-2021 15:09

Sharing

Report Analysis Logs

General

Target

ff734fe39dbcfde88977691062d0a6c17385424c3dd8b4ddeb475368d2cb7205.dll
Size

429KB
MD5

31a5457f8489684515aca714b2305570
SHA1

c9ee56173f91ff7376a41246547ba9b78d92334f
SHA256

ff734fe39dbcfde88977691062d0a6c17385424c3dd8b4ddeb475368d2cb7205
SHA512

2d4cf4a13ecdc3bd243c8451d4c82e37af807d0f4bf0d1920f1e2765105752ea2f2964a76ee5a93a6de6103422f11574e504dd05415722b17ed9e727035474e3

Score

10^/10

icedid 548569227 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

548569227

C2

buzzinmaster.live

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3984 created 564 3984 WerFault.exe regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3984 564 WerFault.exe regsvr32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe
3984	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 3984 WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ff734fe39dbcfde88977691062d0a6c17385424c3dd8b4ddeb475368d2cb7205.dll
1⤵
PID:564

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 564 -s 492
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-114-0x0000000000C60000-0x0000000000C67000-memory.dmp

Filesize
28KB

Download