icedid | 90c29a66209be554dfbd2740f6a54d12616da35d0e5e4af97eb2376b9d053457

Target

data.dll
Size

635KB
MD5

037108e76aea0fb082896b0dfa806a8a
SHA1

cc1035bbb80813ba53ae7ad74b8649a4c696e9a1
SHA256

90c29a66209be554dfbd2740f6a54d12616da35d0e5e4af97eb2376b9d053457
SHA512

ebb5fb84a4a1e654de8f7d38dc22d0586266ae58baee9304cd290ba34bcdf8328c7c3c0c243bc996e5e6134fa3aa0948bfc8651259fd3f258722e0da525d9971

Score

10^/10

Malware Config

Family

icedid

Campaign

952864090

biglaneat.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1400 1940 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exeWerFault.exe

pid process

1940 regsvr32.exe
1940 regsvr32.exe
1400 WerFault.exe
1400 WerFault.exe
1400 WerFault.exe
1400 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1400 WerFault.exe

pid	pid_target	process	target process
1400	1940	WerFault.exe	regsvr32.exe

description	pid	process
Token: SeDebugPrivilege	1400	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1940 wrote to memory of 1400	1940	regsvr32.exe	WerFault.exe
PID 1940 wrote to memory of 1400	1940	regsvr32.exe	WerFault.exe
PID 1940 wrote to memory of 1400	1940	regsvr32.exe	WerFault.exe

memory/1400-57-0x0000000001DE0000-0x0000000001DE1000-memory.dmp

Filesize
4KB

Download
memory/1940-54-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Filesize
8KB

Download
memory/1940-55-0x00000000001A0000-0x00000000001AB000-memory.dmp

Filesize
44KB

Download