icedid | 381bc1e31d7798fe7027c7a881a885725c9c24081348a012fb210b4b9b28e2e5

Analysis

Target

mu7en.dll
Size

649KB
MD5

2e16ac562a24c3afa850d2c7b9495644
SHA1

a7155bfe2ec0af534d89264fc2ebda704c47c27d
SHA256

381bc1e31d7798fe7027c7a881a885725c9c24081348a012fb210b4b9b28e2e5
SHA512

820ad9e9d2e1a81105f0b78e63c66e382341b40d4df25abd5472dc16097c2cf43988baeba55642465c6f8a874dc50f23349e8dc66e8b5b5387658c158e4f0888

Score

10^/10

Family

icedid

Campaign

3400213397

coolnexoz.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata

Blocklisted process makes network request 20 IoCs

Processes:

rundll32.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exerundll32.exe

pid process

2172 powershell.exe
2172 powershell.exe
2172 powershell.exe
1536 rundll32.exe
1536 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2172 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2172	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

powershell.execmd.exe

description	pid	process	target process
PID 2172 wrote to memory of 2772	2172	powershell.exe	cmd.exe
PID 2172 wrote to memory of 2772	2172	powershell.exe	cmd.exe
PID 2772 wrote to memory of 1536	2772	cmd.exe	rundll32.exe
PID 2772 wrote to memory of 1536	2772	cmd.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mu7en.dll,#1
1⤵
PID:1240

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2772

memory/1536-172-0x0000000000000000-mapping.dmp

Download
memory/1536-173-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/2172-123-0x000001D86E750000-0x000001D86E772000-memory.dmp

Filesize
136KB

Download
memory/2172-144-0x000001D86ED10000-0x000001D86ED4C000-memory.dmp

Filesize
240KB

Download
memory/2172-155-0x000001D86EDD0000-0x000001D86EE46000-memory.dmp

Filesize
472KB

Download
memory/2772-170-0x0000000000000000-mapping.dmp

Download