icedid | 51c5710fbad680e386041b316cffad781133a5c21acc1fca509bebc1dc4ddbf6

Analysis

Target

51c5710fbad680e386041b316cffad781133a5c21acc1fca509bebc1dc4ddbf6.dll
Size

143KB
MD5

a571e2f0069549d7bed9d4ac67fc98bd
SHA1

dbf47c38a24f9c81720cb5b955fb496bb337117c
SHA256

51c5710fbad680e386041b316cffad781133a5c21acc1fca509bebc1dc4ddbf6
SHA512

614553677dccdb06eeb9d36987c67b0fad41f086b13a298fbc768d131a16bca006a428091329e066c356ae05013e85eb897cb2a3cc6f31a9f32b0e18e9422b2d

Score

10^/10

Family

icedid

felpojdhf8980.cyou

azoperfdeoti85.xyz

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/1824-56-0x0000000074370000-0x0000000074376000-memory.dmp	IcedidSecondLoader
behavioral1/memory/1824-57-0x0000000074370000-0x00000000743AA000-memory.dmp	IcedidSecondLoader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1860 wrote to memory of 1824	1860	regsvr32.exe	regsvr32.exe
PID 1860 wrote to memory of 1824	1860	regsvr32.exe	regsvr32.exe
PID 1860 wrote to memory of 1824	1860	regsvr32.exe	regsvr32.exe
PID 1860 wrote to memory of 1824	1860	regsvr32.exe	regsvr32.exe
PID 1860 wrote to memory of 1824	1860	regsvr32.exe	regsvr32.exe
PID 1860 wrote to memory of 1824	1860	regsvr32.exe	regsvr32.exe
PID 1860 wrote to memory of 1824	1860	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\51c5710fbad680e386041b316cffad781133a5c21acc1fca509bebc1dc4ddbf6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\51c5710fbad680e386041b316cffad781133a5c21acc1fca509bebc1dc4ddbf6.dll
2⤵
PID:1824

memory/1824-55-0x0000000075E61000-0x0000000075E63000-memory.dmp

Filesize
8KB

Download
memory/1824-56-0x0000000074370000-0x0000000074376000-memory.dmp

Filesize
24KB

Download
memory/1824-58-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1824-57-0x0000000074370000-0x00000000743AA000-memory.dmp

Filesize
232KB

Download
memory/1860-54-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Filesize
8KB

Download