icedid | 90c29a66209be554dfbd2740f6a54d12616da35d0e5e4af97eb2376b9d053457

Target

data.dll
Size

635KB
MD5

037108e76aea0fb082896b0dfa806a8a
SHA1

cc1035bbb80813ba53ae7ad74b8649a4c696e9a1
SHA256

90c29a66209be554dfbd2740f6a54d12616da35d0e5e4af97eb2376b9d053457
SHA512

ebb5fb84a4a1e654de8f7d38dc22d0586266ae58baee9304cd290ba34bcdf8328c7c3c0c243bc996e5e6134fa3aa0948bfc8651259fd3f258722e0da525d9971

Score

10^/10

Malware Config

Family

icedid

Campaign

952864090

biglaneat.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1148 1628 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exeWerFault.exe

pid process

1628 regsvr32.exe
1628 regsvr32.exe
1148 WerFault.exe
1148 WerFault.exe
1148 WerFault.exe
1148 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1148 WerFault.exe

pid	pid_target	process	target process
1148	1628	WerFault.exe	regsvr32.exe

description	pid	process
Token: SeDebugPrivilege	1148	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1628 wrote to memory of 1148	1628	regsvr32.exe	WerFault.exe
PID 1628 wrote to memory of 1148	1628	regsvr32.exe	WerFault.exe
PID 1628 wrote to memory of 1148	1628	regsvr32.exe	WerFault.exe

memory/1148-57-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/1628-54-0x000007FEFB541000-0x000007FEFB543000-memory.dmp

Filesize
8KB

Download
memory/1628-55-0x0000000000130000-0x000000000013B000-memory.dmp

Filesize
44KB

Download