icedid | d4dd79d6d15a6d347984e79644c25063d3b12d9cd37e2d5dd4d587747330e54b

Analysis

Target

data.dll
Size

381KB
MD5

d836f259c55c465bc4926c7b77ea2d40
SHA1

dbd0d4e336360b92312801475d476020637e0cca
SHA256

d4dd79d6d15a6d347984e79644c25063d3b12d9cd37e2d5dd4d587747330e54b
SHA512

e4d9b98dec5b39483ad87417ac991bbf1e06ec81b7bf1499fcb48fcb7781fbb9420d8c80a4b7897d03f0780e4ca3c0bc364b174d002a41001e94dcbbaa96ea25

Score

10^/10

Family

icedid

Campaign

936086471

reseptors.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exeregsvr32.exeregsvr32.exe

pid process

4040 powershell.exe
4040 powershell.exe
4040 powershell.exe
1848 regsvr32.exe
1848 regsvr32.exe
1740 regsvr32.exe
1740 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4040 powershell.exe

description	pid	process
Token: SeDebugPrivilege	4040	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

powershell.execmd.exe

description	pid	process	target process
PID 4040 wrote to memory of 1140	4040	powershell.exe	cmd.exe
PID 4040 wrote to memory of 1140	4040	powershell.exe	cmd.exe
PID 1140 wrote to memory of 1740	1140	cmd.exe	regsvr32.exe
PID 1140 wrote to memory of 1740	1140	cmd.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\data.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1848

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1140

C:\Windows\system32\regsvr32.exe
regsvr32 data.dll
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1740

memory/1848-172-0x0000000001310000-0x000000000131B000-memory.dmp

Filesize
44KB

Download
memory/4040-119-0x000002BBF5A90000-0x000002BBF5AB2000-memory.dmp

Filesize
136KB

Download
memory/4040-129-0x000002BBF59A0000-0x000002BBF59A2000-memory.dmp

Filesize
8KB

Download
memory/4040-128-0x00007FF9AD813000-0x00007FF9AD814000-memory.dmp

Filesize
4KB

Download
memory/4040-130-0x000002BBF59A3000-0x000002BBF59A5000-memory.dmp

Filesize
8KB

Download
memory/4040-143-0x000002BBF67A0000-0x000002BBF67DC000-memory.dmp

Filesize
240KB

Download
memory/4040-154-0x000002BBF6CF0000-0x000002BBF6D66000-memory.dmp

Filesize
472KB

Download