icedid | 081c063a81c4c470c66507c03419f116440afa1c905ae8b0734e924ff72c1aae

Analysis

Target

bc6a441a3036c1310886b671943e487d47f2c7d1b4bd125d7b0cf0f3090b8281.dll

Score

10^/10

Family

icedid

Campaign

412701809

hdtrenity.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1800 1864 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

regsvr32.exeWerFault.exe

pid process

1864 regsvr32.exe
1864 regsvr32.exe
1800 WerFault.exe
1800 WerFault.exe
1800 WerFault.exe
1800 WerFault.exe
1800 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1800 WerFault.exe

pid	pid_target	process	target process
1800	1864	WerFault.exe	regsvr32.exe

description	pid	process
Token: SeDebugPrivilege	1800	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1864 wrote to memory of 1800	1864	regsvr32.exe	WerFault.exe
PID 1864 wrote to memory of 1800	1864	regsvr32.exe	WerFault.exe
PID 1864 wrote to memory of 1800	1864	regsvr32.exe	WerFault.exe

memory/1800-57-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1864-54-0x000007FEFB8C1000-0x000007FEFB8C3000-memory.dmp

Filesize
8KB

Download
memory/1864-55-0x00000000001A0000-0x00000000001AF000-memory.dmp

Filesize
60KB

Download