icedid | acede4e871ff7ebeda48cd568f8761e7129ed6f596cccbbdce7634e58ecbd7e8

Analysis

Target

HUBzaedwKZmf.dll
Size

815KB
MD5

cbe01f7b59cb028d55e02e2a91277820
SHA1

479c7c4c5fb5a1d6de5f3d0f648afff6ed3120d8
SHA256

acede4e871ff7ebeda48cd568f8761e7129ed6f596cccbbdce7634e58ecbd7e8
SHA512

722a4b458d8d5c4776d0a2f49861c92fe6268ee40efd775744e123fdfec97c8b75ed6781b84b47f5f0f407251518fc88b3b289d77cf98632cfff1c9c48449a65

Score

10^/10

Family

icedid

Campaign

3417632220

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

760 1516 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exeWerFault.exe

pid process

1516 regsvr32.exe
1516 regsvr32.exe
760 WerFault.exe
760 WerFault.exe
760 WerFault.exe
760 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

760 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 760 WerFault.exe

pid	pid_target	process	target process
760	1516	WerFault.exe	regsvr32.exe

pid	process
760	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	760	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1516 wrote to memory of 760	1516	regsvr32.exe	WerFault.exe
PID 1516 wrote to memory of 760	1516	regsvr32.exe	WerFault.exe
PID 1516 wrote to memory of 760	1516	regsvr32.exe	WerFault.exe

memory/760-57-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1516-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Filesize
8KB

Download
memory/1516-55-0x0000000001C00000-0x0000000001C0E000-memory.dmp

Filesize
56KB

Download