icedid | e190c0c0b31deb30652a9807ed76082eae1f12382e400f0d1295023a96d46cdd

Analysis

Target

Fromware.dll.4.dll
Size

1000KB
MD5

72e3a54ef288d301e51c7e962ffc8213
SHA1

1f2ee2dcc17aeb3fd60baee69540ca73e135bc85
SHA256

44cc69061248ec0671ce9462c4561bd376f1b14c3f8f9b1d9ca94918cd96cb21
SHA512

f0e5e083c48483af8d5690a20c9cef9033257d08df23b84636c3bc49478fe51b94635f122b5e54540bfde1e6d508fa40e49ee5103d6970651ca57d44956ae8c6

Score

10^/10

Family

icedid

Campaign

3864687680

yellwells.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

34 3168 rundll32.exe
35 4772 rundll32.exe
57 4772 rundll32.exe
Loads dropped DLL 2 IoCs

Processes:

rundll32.exerundll32.exe

pid process

4772 rundll32.exe
3168 rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exerundll32.exe

pid process

3168 rundll32.exe
4772 rundll32.exe
3168 rundll32.exe
4772 rundll32.exe

pid	process
4772	rundll32.exe
3168	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2064 wrote to memory of 3168	2064	rundll32.exe	rundll32.exe
PID 2064 wrote to memory of 3168	2064	rundll32.exe	rundll32.exe
PID 2064 wrote to memory of 4772	2064	rundll32.exe	rundll32.exe
PID 2064 wrote to memory of 4772	2064	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fromware.dll.4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064

C:\Users\Admin\pycharmer.dll
Filesize
121KB

MD5
fa9c59738cf8c143009085696f9a0921

SHA1
84d295c6f2cb9b01c6c536bd629322c0bc5b5100

SHA256
aa99a141a4d0529c799bd2feef7bc86b2b227cf53c30e8a1ba1a4aae136a0d15

SHA512
cb96b31d860488d2dfcf4842ab3073b01280649a12297a720378fe4ca97dc1073ce6f8cd528212eab50abb571850031d2422a6a374cd7e587fa8b3b7bed13484

Download Submit
C:\Users\Admin\pycharmer.dll
Filesize
121KB

MD5
fa9c59738cf8c143009085696f9a0921

SHA1
84d295c6f2cb9b01c6c536bd629322c0bc5b5100

SHA256
aa99a141a4d0529c799bd2feef7bc86b2b227cf53c30e8a1ba1a4aae136a0d15

SHA512
cb96b31d860488d2dfcf4842ab3073b01280649a12297a720378fe4ca97dc1073ce6f8cd528212eab50abb571850031d2422a6a374cd7e587fa8b3b7bed13484

Download Submit
C:\Users\Admin\pycharmer.dll
Filesize
121KB

MD5
fa9c59738cf8c143009085696f9a0921

SHA1
84d295c6f2cb9b01c6c536bd629322c0bc5b5100

SHA256
aa99a141a4d0529c799bd2feef7bc86b2b227cf53c30e8a1ba1a4aae136a0d15

SHA512
cb96b31d860488d2dfcf4842ab3073b01280649a12297a720378fe4ca97dc1073ce6f8cd528212eab50abb571850031d2422a6a374cd7e587fa8b3b7bed13484

Download Submit
memory/3168-130-0x0000000000000000-mapping.dmp

Download
memory/3168-135-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/4772-131-0x0000000000000000-mapping.dmp

Download