icedid | cecb397cea8fda07826578b798f0bde12053ea4bcb6bed6e057ea4d7a20fbb8b

Analysis

Target

main2.dll
Size

1.2MB
MD5

84e2db5363fc3e1b50f4ffbcc24094b1
SHA1

e538933c86c67baf070ccd2f3db06e1f9d9d9636
SHA256

cecb397cea8fda07826578b798f0bde12053ea4bcb6bed6e057ea4d7a20fbb8b
SHA512

1bfe51a292cf30a3af34e5d0f1ded75406efbc2c9bf19530ed4094c08c76fe9c272ce129b0d6a1a3b640793f55586ff4f58e7cff151b9f72ff0b8a6a7c1546a2

Score

10^/10

Family

icedid

Campaign

3993579037

yourgroceries.top

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exeregsvr32.exeregsvr32.exe

pid process

2464 powershell.exe
2464 powershell.exe
2464 powershell.exe
2204 regsvr32.exe
2204 regsvr32.exe
3700 regsvr32.exe
3700 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2464 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2464	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

powershell.execmd.exe

description	pid	process	target process
PID 2464 wrote to memory of 940	2464	powershell.exe	cmd.exe
PID 2464 wrote to memory of 940	2464	powershell.exe	cmd.exe
PID 940 wrote to memory of 3700	940	cmd.exe	regsvr32.exe
PID 940 wrote to memory of 3700	940	cmd.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\main2.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2204

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\system32\regsvr32.exe
regsvr32 main2.dll
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3700

memory/2204-172-0x0000000000D20000-0x0000000000D4B000-memory.dmp

Filesize
172KB

Download
memory/2464-119-0x00000218C2050000-0x00000218C2072000-memory.dmp

Filesize
136KB

Download
memory/2464-139-0x00000218C20C0000-0x00000218C20FC000-memory.dmp

Filesize
240KB

Download
memory/2464-141-0x00007FFA1DC60000-0x00007FFA1E64C000-memory.dmp

Filesize
9.9MB

Download
memory/2464-143-0x00000218C1BB0000-0x00000218C1BB2000-memory.dmp

Filesize
8KB

Download
memory/2464-145-0x00000218C1BB3000-0x00000218C1BB5000-memory.dmp

Filesize
8KB

Download
memory/2464-153-0x00000218DB220000-0x00000218DB296000-memory.dmp

Filesize
472KB

Download
memory/3700-173-0x0000000000510000-0x000000000051B000-memory.dmp

Filesize
44KB

Download