icedid | bc6a441a3036c1310886b671943e487d47f2c7d1b4bd125d7b0cf0f3090b8281

Analysis

Target

bc6a441a3036c1310886b671943e487d47f2c7d1b4bd125d7b0cf0f3090b8281.dll
Size

552KB
MD5

791779361e8db64ec7fbeb8b82d68ce7
SHA1

8632bff9f308fa57ae5bd1aad56b5ec8ff91f466
SHA256

bc6a441a3036c1310886b671943e487d47f2c7d1b4bd125d7b0cf0f3090b8281
SHA512

da4b1b98c6d190311cc5df10c91560a2818d8aa1707d9d77a8fe4275d99766ff29f3d39588b200986f3d0e5eb001a72b5b459f1e95e1e34d875ceb531d6079b4

Score

10^/10

Family

icedid

Campaign

412701809

hdtrenity.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1136 1520 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

regsvr32.exeWerFault.exe

pid process

1520 regsvr32.exe
1520 regsvr32.exe
1136 WerFault.exe
1136 WerFault.exe
1136 WerFault.exe
1136 WerFault.exe
1136 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1136 WerFault.exe

pid	pid_target	process	target process
1136	1520	WerFault.exe	regsvr32.exe

description	pid	process
Token: SeDebugPrivilege	1136	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1520 wrote to memory of 1136	1520	regsvr32.exe	WerFault.exe
PID 1520 wrote to memory of 1136	1520	regsvr32.exe	WerFault.exe
PID 1520 wrote to memory of 1136	1520	regsvr32.exe	WerFault.exe

memory/1136-57-0x0000000001C20000-0x0000000001C21000-memory.dmp

Filesize
4KB

Download
memory/1520-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Filesize
8KB

Download
memory/1520-55-0x00000000004B0000-0x00000000004BF000-memory.dmp

Filesize
60KB

Download