icedid | b2b49d407ff86ea9319ed2dc00a91f69ecdbd7e8fa24978363e5686ac0653722

Analysis

Target

2dc18df6aa58c8646823c532debd0522e0cda5bb113b02caebadb4489ba48ce4.dll
Size

560KB
MD5

028c9df1c4a5bac64cddc56a4c0f3164
SHA1

a329dceb650bddb840bbc8671fcae06811eef391
SHA256

2dc18df6aa58c8646823c532debd0522e0cda5bb113b02caebadb4489ba48ce4
SHA512

83430bc058036c40172751603594605efbf228955cdfd2d6a5b7d47287658c4b922d993165c7fabcfb82d35383c135305b38135ed3438708d02a28f3b48f774a

Score

10^/10

Family

icedid

Campaign

3384076982

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

804 952 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

regsvr32.exeWerFault.exe

pid process

952 regsvr32.exe
952 regsvr32.exe
804 WerFault.exe
804 WerFault.exe
804 WerFault.exe
804 WerFault.exe
804 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 804 WerFault.exe

pid	pid_target	process	target process
804	952	WerFault.exe	regsvr32.exe

description	pid	process
Token: SeDebugPrivilege	804	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 952 wrote to memory of 804	952	regsvr32.exe	WerFault.exe
PID 952 wrote to memory of 804	952	regsvr32.exe	WerFault.exe
PID 952 wrote to memory of 804	952	regsvr32.exe	WerFault.exe

memory/804-57-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/952-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Filesize
8KB

Download
memory/952-55-0x00000000003A0000-0x00000000003AF000-memory.dmp

Filesize
60KB

Download