icedid | 16c00b9d56ad2f7d20409313a85a0a6375047a3a975ccc8e9e80afbf1c20bd5f

Analysis

Target

main1.dll
Size

1.2MB
MD5

657b8f163f8fcb7364d0710f69ccdadd
SHA1

aa035a6c9eb17be8065026fa8226c5cbbe7813c5
SHA256

16c00b9d56ad2f7d20409313a85a0a6375047a3a975ccc8e9e80afbf1c20bd5f
SHA512

1d2bc7edc534046bfbf065ec12ff825b1d553a0ff55e82368f657725ab935a7923ad71529eac42b56f37492c063b3592a313d41fb541a2645f90b8b29c79dc52

Score

10^/10

Family

icedid

Campaign

3993579037

yourgroceries.top

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1780 1112 WerFault.exe regsvr32.exe
1740 1260 WerFault.exe regsvr32.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

regsvr32.exe

pid process

1260 regsvr32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1112 regsvr32.exe
1112 regsvr32.exe
1260 regsvr32.exe
1260 regsvr32.exe

pid	pid_target	process	target process
1780	1112	WerFault.exe	regsvr32.exe
1740	1260	WerFault.exe	regsvr32.exe

pid	process
1260	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

cmd.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1680 wrote to memory of 1260	1680	cmd.exe	regsvr32.exe
PID 1680 wrote to memory of 1260	1680	cmd.exe	regsvr32.exe
PID 1680 wrote to memory of 1260	1680	cmd.exe	regsvr32.exe
PID 1680 wrote to memory of 1260	1680	cmd.exe	regsvr32.exe
PID 1680 wrote to memory of 1260	1680	cmd.exe	regsvr32.exe
PID 1112 wrote to memory of 1780	1112	regsvr32.exe	WerFault.exe
PID 1112 wrote to memory of 1780	1112	regsvr32.exe	WerFault.exe
PID 1112 wrote to memory of 1780	1112	regsvr32.exe	WerFault.exe
PID 1260 wrote to memory of 1740	1260	regsvr32.exe	WerFault.exe
PID 1260 wrote to memory of 1740	1260	regsvr32.exe	WerFault.exe
PID 1260 wrote to memory of 1740	1260	regsvr32.exe	WerFault.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1112 -s 252
2⤵
- Program crash
PID:1780

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1260 -s 252
3⤵
- Program crash
PID:1740

memory/1112-54-0x000007FEFB981000-0x000007FEFB983000-memory.dmp

Filesize
8KB

Download
memory/1112-56-0x00000000002A0000-0x00000000002AB000-memory.dmp

Filesize
44KB

Download