icedid | 59ddf7fd2901ffddc12d730d41a59ef51a0cf834145bcf883d8c1106b6aad0c7

Analysis

Target

vGhhsvfLkp.ps1
Size

61B
MD5

8436a7bea697c48edaf67b93f46d02b0
SHA1

6f61548db8a87df80e2ca4f37fd02d70edae3e16
SHA256

7431c53295cf5952fc32ad1da45022c644d54578ed0ae55c0837b8b25e005e19
SHA512

b22ff1716ee34789f7ca168c93e768d37c05d4ce37345799645ced25e5742b44c79741a05db73995028bb7be6219f03b9b5670bff569a6281ef5fb33b78d654c

Score

10^/10

Family

icedid

Campaign

3239568078

carbrownleger.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

12 800 rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exerundll32.exe

pid process

4720 powershell.exe
4720 powershell.exe
800 rundll32.exe
800 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4720 powershell.exe

flow	pid	process
12	800	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	4720	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 4720 wrote to memory of 800	4720	powershell.exe	rundll32.exe
PID 4720 wrote to memory of 800	4720	powershell.exe	rundll32.exe

memory/800-132-0x0000000000000000-mapping.dmp

Download
memory/800-134-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/4720-130-0x00000235C4290000-0x00000235C42B2000-memory.dmp

Filesize
136KB

Download
memory/4720-131-0x00007FFADD9E0000-0x00007FFADE4A1000-memory.dmp

Filesize
10.8MB

Download
memory/4720-133-0x00007FFADD9E0000-0x00007FFADE4A1000-memory.dmp

Filesize
10.8MB

Download