icedid | 0f5fbad82dae02e2a48775762f8ff0eb067eb4f81ce637607ac893d4e0c613b3

Analysis

Target

2d1655895c0dde4bc010c51b9b878c46.dll
Size

570KB
MD5

2d1655895c0dde4bc010c51b9b878c46
SHA1

fb73914210b56c020a816325b3a5adb185e8f3ee
SHA256

0f5fbad82dae02e2a48775762f8ff0eb067eb4f81ce637607ac893d4e0c613b3
SHA512

08947de9e604fde5ef451302ba0591999aa864f96577986cdeebe2f9325e2f936940deb413bf872c94e9007c9997fd036f25a30208f763cfd163860b624aeed1

Score

10^/10

Family

icedid

Campaign

1117948791

reseptors.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1380 1880 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

regsvr32.exeWerFault.exe

pid process

1880 regsvr32.exe
1880 regsvr32.exe
1380 WerFault.exe
1380 WerFault.exe
1380 WerFault.exe
1380 WerFault.exe
1380 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1380 WerFault.exe

pid	pid_target	process	target process
1380	1880	WerFault.exe	regsvr32.exe

description	pid	process
Token: SeDebugPrivilege	1380	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1880 wrote to memory of 1380	1880	regsvr32.exe	WerFault.exe
PID 1880 wrote to memory of 1380	1880	regsvr32.exe	WerFault.exe
PID 1880 wrote to memory of 1380	1880	regsvr32.exe	WerFault.exe

memory/1380-57-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1880-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Filesize
8KB

Download
memory/1880-55-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download