icedid | cecb397cea8fda07826578b798f0bde12053ea4bcb6bed6e057ea4d7a20fbb8b

Analysis

Target

main2.dll
Size

1.2MB
MD5

84e2db5363fc3e1b50f4ffbcc24094b1
SHA1

e538933c86c67baf070ccd2f3db06e1f9d9d9636
SHA256

cecb397cea8fda07826578b798f0bde12053ea4bcb6bed6e057ea4d7a20fbb8b
SHA512

1bfe51a292cf30a3af34e5d0f1ded75406efbc2c9bf19530ed4094c08c76fe9c272ce129b0d6a1a3b640793f55586ff4f58e7cff151b9f72ff0b8a6a7c1546a2

Score

10^/10

Family

icedid

Campaign

3993579037

yourgroceries.top

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1256 1088 WerFault.exe regsvr32.exe
684 444 WerFault.exe regsvr32.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

regsvr32.exe

pid process

444 regsvr32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1088 regsvr32.exe
1088 regsvr32.exe
444 regsvr32.exe
444 regsvr32.exe

pid	pid_target	process	target process
1256	1088	WerFault.exe	regsvr32.exe
684	444	WerFault.exe	regsvr32.exe

pid	process
444	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

cmd.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1240 wrote to memory of 444	1240	cmd.exe	regsvr32.exe
PID 1240 wrote to memory of 444	1240	cmd.exe	regsvr32.exe
PID 1240 wrote to memory of 444	1240	cmd.exe	regsvr32.exe
PID 1240 wrote to memory of 444	1240	cmd.exe	regsvr32.exe
PID 1240 wrote to memory of 444	1240	cmd.exe	regsvr32.exe
PID 1088 wrote to memory of 1256	1088	regsvr32.exe	WerFault.exe
PID 1088 wrote to memory of 1256	1088	regsvr32.exe	WerFault.exe
PID 1088 wrote to memory of 1256	1088	regsvr32.exe	WerFault.exe
PID 444 wrote to memory of 684	444	regsvr32.exe	WerFault.exe
PID 444 wrote to memory of 684	444	regsvr32.exe	WerFault.exe
PID 444 wrote to memory of 684	444	regsvr32.exe	WerFault.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1088 -s 252
2⤵
- Program crash
PID:1256

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 444 -s 252
3⤵
- Program crash
PID:684

memory/444-57-0x0000000000120000-0x000000000012B000-memory.dmp

Filesize
44KB

Download
memory/1088-54-0x000007FEFBD31000-0x000007FEFBD33000-memory.dmp

Filesize
8KB

Download
memory/1088-56-0x0000000000130000-0x000000000013B000-memory.dmp

Filesize
44KB

Download