icedid | 9e32d82f6649df430b1a3c7b50cd2dd2e3a55f1262b17ffe9df889c1cad4f641

Analysis

Target

main.dll
Size

1.2MB
MD5

e837721973bddc2555f675f89c6121fa
SHA1

5f03d305a3326fd0a7417b3a1d91e310db892f4b
SHA256

2c1e2e0a9ea8e180d9323229d780590df4bd1a90781e6eebc85d9c9b0b5f41c4
SHA512

fdb649c3b3f0cf36f77776fd059e6a5f19be79b2bddd66615d69b0f2633f2ee65a8ddaca3a474c899640fca1243b8f6791b89bc495c27c54929e745f134b0a50

Score

10^/10

Family

icedid

Campaign

2401334462

emicthatmov.top

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1468 1012 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1012 regsvr32.exe
1012 regsvr32.exe

pid	pid_target	process	target process
1468	1012	WerFault.exe	regsvr32.exe

pid	process
1012	regsvr32.exe
1012	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1012 wrote to memory of 1468	1012	regsvr32.exe	WerFault.exe
PID 1012 wrote to memory of 1468	1012	regsvr32.exe	WerFault.exe
PID 1012 wrote to memory of 1468	1012	regsvr32.exe	WerFault.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1012 -s 244
2⤵
- Program crash
PID:1468

memory/1012-54-0x000007FEFBB61000-0x000007FEFBB63000-memory.dmp

Filesize
8KB

Download
memory/1012-55-0x0000000000120000-0x000000000012B000-memory.dmp

Filesize
44KB

Download