icedid | 16c00b9d56ad2f7d20409313a85a0a6375047a3a975ccc8e9e80afbf1c20bd5f

Analysis

Target

main1.dll
Size

1.2MB
MD5

657b8f163f8fcb7364d0710f69ccdadd
SHA1

aa035a6c9eb17be8065026fa8226c5cbbe7813c5
SHA256

16c00b9d56ad2f7d20409313a85a0a6375047a3a975ccc8e9e80afbf1c20bd5f
SHA512

1d2bc7edc534046bfbf065ec12ff825b1d553a0ff55e82368f657725ab935a7923ad71529eac42b56f37492c063b3592a313d41fb541a2645f90b8b29c79dc52

Score

10^/10

Family

icedid

Campaign

3993579037

yourgroceries.top

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exeregsvr32.exeregsvr32.exe

pid process

1924 powershell.exe
1924 powershell.exe
1924 powershell.exe
4180 regsvr32.exe
4180 regsvr32.exe
4256 regsvr32.exe
4256 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1924 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1924	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

powershell.execmd.exe

description	pid	process	target process
PID 1924 wrote to memory of 4320	1924	powershell.exe	cmd.exe
PID 1924 wrote to memory of 4320	1924	powershell.exe	cmd.exe
PID 4320 wrote to memory of 4256	4320	cmd.exe	regsvr32.exe
PID 4320 wrote to memory of 4256	4320	cmd.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\main1.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4180

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4320

C:\Windows\system32\regsvr32.exe
regsvr32 main1.dll
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4256

memory/1924-120-0x000001A874990000-0x000001A8749B2000-memory.dmp

Filesize
136KB

Download
memory/1924-121-0x00007FFB5AED0000-0x00007FFB5B8BC000-memory.dmp

Filesize
9.9MB

Download
memory/1924-122-0x000001A8729B0000-0x000001A8729B2000-memory.dmp

Filesize
8KB

Download
memory/1924-123-0x000001A8729B3000-0x000001A8729B5000-memory.dmp

Filesize
8KB

Download
memory/1924-143-0x000001A875890000-0x000001A8758CC000-memory.dmp

Filesize
240KB

Download
memory/1924-154-0x000001A875950000-0x000001A8759C6000-memory.dmp

Filesize
472KB

Download
memory/4180-172-0x00000000007B0000-0x00000000007DB000-memory.dmp

Filesize
172KB

Download
memory/4256-173-0x0000000001030000-0x000000000103B000-memory.dmp

Filesize
44KB

Download