icedid | 1c471f6693f916a16134d04315134fab29cb616b7f58b1a524cf7eba98fa5a2d

Analysis

Target

nerol3.dll
Size

634KB
MD5

da15f2de43f2df16ea07adf3b2424bac
SHA1

44c7d4abd240045e79ce9add5a84fbf07033e3f7
SHA256

e8159b1cc7d56945d77037837be466a7363a7963d1256e9acbcdd6e0e0806899
SHA512

357981c9dd9faa5326d653eccfebeb54b59f9a2abfc3e0e4bf63032ee982d83bc94c5a5225a1ce8d483d18cf3b72050e696c90bf6ce02fc5bcbec3a46c853384

Score

10^/10

Family

icedid

Campaign

3118344709

speratinda.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

66 2280 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2280 rundll32.exe
2280 rundll32.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 3432 wrote to memory of 2280 3432 cmd.exe rundll32.exe
PID 3432 wrote to memory of 2280 3432 cmd.exe rundll32.exe

flow	pid	process
66	2280	rundll32.exe

pid	process
2280	rundll32.exe
2280	rundll32.exe

description	pid	process	target process
PID 3432 wrote to memory of 2280	3432	cmd.exe	rundll32.exe
PID 3432 wrote to memory of 2280	3432	cmd.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nerol3.dll,#1
1⤵
PID:2288

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3432

memory/2280-130-0x0000000000000000-mapping.dmp

Download
memory/2280-131-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download