icedid | 101b6b6bec4ae6e698d793d1f9d1a905c03bac2da987ba68033a16fed414a95c

Analysis

Target

AnyDesk.exe
Size

1.6MB
MD5

397640d8c42e1f06cc45fb6ce689be8b
SHA1

8e56c7883ad7eefa314b9a4f234f1b59a9e7f8fb
SHA256

101b6b6bec4ae6e698d793d1f9d1a905c03bac2da987ba68033a16fed414a95c
SHA512

60708d311b7bd473f6981de94ccfea05c22e956944c675ac9b457b2585e53d5bd132db70a1df9dbb9b7c1077c6b819cf4cbbc57b18503d8602442a3415ba8166

Score

10^/10

Family

icedid

Campaign

494770699

oceriesfornot.top

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1356 948 WerFault.exe AnyDesk.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

AnyDesk.exeWerFault.exe

pid process

948 AnyDesk.exe
948 AnyDesk.exe
1356 WerFault.exe
1356 WerFault.exe
1356 WerFault.exe
1356 WerFault.exe
1356 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1356 WerFault.exe

pid	pid_target	process	target process
1356	948	WerFault.exe	AnyDesk.exe

description	pid	process
Token: SeDebugPrivilege	1356	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

AnyDesk.exe

description	pid	process	target process
PID 948 wrote to memory of 1356	948	AnyDesk.exe	WerFault.exe
PID 948 wrote to memory of 1356	948	AnyDesk.exe	WerFault.exe
PID 948 wrote to memory of 1356	948	AnyDesk.exe	WerFault.exe

memory/948-55-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1356-56-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Filesize
8KB

Download
memory/1356-57-0x0000000001B50000-0x0000000001B51000-memory.dmp

Filesize
4KB

Download