icedid | 98b3471ac865e7cc6cc5712ab0db76c476fd861828267284a6aa40c802737b2e

Analysis

Target

crypted_loader_dll_64Donat_3.dll
Size

148KB
MD5

9441c0354b8f4d484019621afb3036ad
SHA1

36a1361c0685f43dbe11153fbae925fc6d048dcc
SHA256

98b3471ac865e7cc6cc5712ab0db76c476fd861828267284a6aa40c802737b2e
SHA512

8d1bd9eb6065b4320bcc2477249a91bed6f96f6cfd8bc632e90fd4f23b9b3d902333c3707ae294b7fb7c237db95e67f238404ad28bf730fdf186c809b576c6cc

Score

10^/10

Family

icedid

Campaign

1832122140

rivertimad.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2004 792 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

792 regsvr32.exe
792 regsvr32.exe

pid	pid_target	process	target process
2004	792	WerFault.exe	regsvr32.exe

pid	process
792	regsvr32.exe
792	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 792 wrote to memory of 2004	792	regsvr32.exe	WerFault.exe
PID 792 wrote to memory of 2004	792	regsvr32.exe	WerFault.exe
PID 792 wrote to memory of 2004	792	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\crypted_loader_dll_64Donat_3.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:792
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 792 -s 256
  2⤵
  - Program crash
  PID:2004

memory/792-54-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmp

Filesize
8KB

Download
memory/792-55-0x0000000180000000-0x000000018000B000-memory.dmp

Filesize
44KB

Download
memory/2004-61-0x0000000000000000-mapping.dmp

Download