icedid | 87502ec6bc99fdad2d6092b022d35446123fd00e8ab9b5831939d32b7ba5a4de

Analysis

Target

UFbjRkMGfw.ps1
Size

59B
MD5

219543beb2dbd3dd4a38133cb4cf5d62
SHA1

a9f3bca1e95a8013e54a327ab471fa90f4d6fdec
SHA256

ff4878fee00d54134fffa5ca90af7ec4892d7397dafe5ad8a319ab83f9b594ae
SHA512

adfc8567036636ebcbd46d860eacdf55edaff7a56af5a65f0c4695fe2698fa8bc5c7afa1b75126450417516851b500bb3b8d1a1211dae279d6ef95c1621aab26

Score

10^/10

Family

icedid

Campaign

1842176049

carismortht.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1056 rundll32.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1828 NOTEPAD.EXE
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exerundll32.exe

pid process

272 powershell.exe
272 powershell.exe
272 powershell.exe
1056 rundll32.exe
1056 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 272 powershell.exe

flow	pid	process
2	1056	rundll32.exe

pid	process
1828	NOTEPAD.EXE

description	pid	process
Token: SeDebugPrivilege	272	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 272 wrote to memory of 1828	272	powershell.exe	NOTEPAD.EXE
PID 272 wrote to memory of 1828	272	powershell.exe	NOTEPAD.EXE
PID 272 wrote to memory of 1828	272	powershell.exe	NOTEPAD.EXE
PID 272 wrote to memory of 1056	272	powershell.exe	rundll32.exe
PID 272 wrote to memory of 1056	272	powershell.exe	rundll32.exe
PID 272 wrote to memory of 1056	272	powershell.exe	rundll32.exe

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\notice.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:1828

memory/272-54-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Filesize
8KB

Download
memory/272-55-0x000007FEF39D0000-0x000007FEF43F3000-memory.dmp

Filesize
10.1MB

Download
memory/272-56-0x000007FEF2E70000-0x000007FEF39CD000-memory.dmp

Filesize
11.4MB

Download
memory/272-57-0x000000001B870000-0x000000001BB6F000-memory.dmp

Filesize
3.0MB

Download
memory/272-58-0x00000000029E4000-0x00000000029E7000-memory.dmp

Filesize
12KB

Download
memory/272-62-0x00000000029EB000-0x0000000002A0A000-memory.dmp

Filesize
124KB

Download
memory/272-63-0x00000000029E4000-0x00000000029E7000-memory.dmp

Filesize
12KB

Download
memory/1056-61-0x0000000000000000-mapping.dmp

Download
memory/1056-64-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1828-59-0x0000000000000000-mapping.dmp

Download