icedid | 4b0e50204999c44b9f7d7fa88aac013056c0e9fe63d88f37e1e7a3212a001a12

Analysis

Target

UFbjRkMGfw.ps1
Size

59B
MD5

219543beb2dbd3dd4a38133cb4cf5d62
SHA1

a9f3bca1e95a8013e54a327ab471fa90f4d6fdec
SHA256

ff4878fee00d54134fffa5ca90af7ec4892d7397dafe5ad8a319ab83f9b594ae
SHA512

adfc8567036636ebcbd46d860eacdf55edaff7a56af5a65f0c4695fe2698fa8bc5c7afa1b75126450417516851b500bb3b8d1a1211dae279d6ef95c1621aab26

Score

10^/10

Family

icedid

Campaign

1842176049

carismortht.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1436 rundll32.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1820 NOTEPAD.EXE
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exerundll32.exe

pid process

1996 powershell.exe
1996 powershell.exe
1996 powershell.exe
1436 rundll32.exe
1436 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1996 powershell.exe

flow	pid	process
2	1436	rundll32.exe

pid	process
1820	NOTEPAD.EXE

description	pid	process
Token: SeDebugPrivilege	1996	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1996 wrote to memory of 1820	1996	powershell.exe	NOTEPAD.EXE
PID 1996 wrote to memory of 1820	1996	powershell.exe	NOTEPAD.EXE
PID 1996 wrote to memory of 1820	1996	powershell.exe	NOTEPAD.EXE
PID 1996 wrote to memory of 1436	1996	powershell.exe	rundll32.exe
PID 1996 wrote to memory of 1436	1996	powershell.exe	rundll32.exe
PID 1996 wrote to memory of 1436	1996	powershell.exe	rundll32.exe

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\notice.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:1820

memory/1436-60-0x0000000000000000-mapping.dmp

Download
memory/1436-64-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1820-59-0x0000000000000000-mapping.dmp

Download
memory/1996-54-0x000007FEFBFD1000-0x000007FEFBFD3000-memory.dmp

Filesize
8KB

Download
memory/1996-55-0x000007FEF44C0000-0x000007FEF4EE3000-memory.dmp

Filesize
10.1MB

Download
memory/1996-56-0x000007FEF3960000-0x000007FEF44BD000-memory.dmp

Filesize
11.4MB

Download
memory/1996-57-0x000000001B780000-0x000000001BA7F000-memory.dmp

Filesize
3.0MB

Download
memory/1996-58-0x0000000002874000-0x0000000002877000-memory.dmp

Filesize
12KB

Download
memory/1996-62-0x000000000287B000-0x000000000289A000-memory.dmp

Filesize
124KB

Download
memory/1996-63-0x0000000002874000-0x0000000002877000-memory.dmp

Filesize
12KB

Download