icedid | 2b7fb3f85ce2ac7167e780c8a9f60741d474a3f785e9f564ef0b8b106b733324

Analysis

Target

2b7fb3f85ce2ac7167e780c8a9f60741d474a3f785e9f564ef0b8b106b733324.dll
Size

19KB
MD5

7dc7b8135515350b677e2ceefb966c20
SHA1

31295fb3590adcc0f58999a972e1ef53520deb3d
SHA256

2b7fb3f85ce2ac7167e780c8a9f60741d474a3f785e9f564ef0b8b106b733324
SHA512

a33cf4e68845c217bc71fa544e6ef542abd25818f724881f6c8400748927eb224f1f0644860dea65db99ab536d013ef1d1129a77567a822fbe25e5438bdb17cd

Score

10^/10

Family

icedid

Campaign

2401334462

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

308 1168 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1168 regsvr32.exe
1168 regsvr32.exe

pid	pid_target	process	target process
308	1168	WerFault.exe	regsvr32.exe

pid	process
1168	regsvr32.exe
1168	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1168 wrote to memory of 308	1168	regsvr32.exe	WerFault.exe
PID 1168 wrote to memory of 308	1168	regsvr32.exe	WerFault.exe
PID 1168 wrote to memory of 308	1168	regsvr32.exe	WerFault.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1168 -s 244
2⤵
- Program crash
PID:308

memory/1168-54-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

Filesize
8KB

Download