icedid | 4b0e50204999c44b9f7d7fa88aac013056c0e9fe63d88f37e1e7a3212a001a12

Analysis

Target

UFbjRkMGfw.ps1
Size

59B
MD5

219543beb2dbd3dd4a38133cb4cf5d62
SHA1

a9f3bca1e95a8013e54a327ab471fa90f4d6fdec
SHA256

ff4878fee00d54134fffa5ca90af7ec4892d7397dafe5ad8a319ab83f9b594ae
SHA512

adfc8567036636ebcbd46d860eacdf55edaff7a56af5a65f0c4695fe2698fa8bc5c7afa1b75126450417516851b500bb3b8d1a1211dae279d6ef95c1621aab26

Score

10^/10

Family

icedid

Campaign

1842176049

carismortht.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

29 2088 rundll32.exe
Modifies registry class 1 IoCs

Processes:

powershell.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings powershell.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4524 NOTEPAD.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exerundll32.exe

pid process

1648 powershell.exe
1648 powershell.exe
2088 rundll32.exe
2088 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1648 powershell.exe

flow	pid	process
29	2088	rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	powershell.exe

pid	process
4524	NOTEPAD.EXE

description	pid	process
Token: SeDebugPrivilege	1648	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1648 wrote to memory of 4524	1648	powershell.exe	NOTEPAD.EXE
PID 1648 wrote to memory of 4524	1648	powershell.exe	NOTEPAD.EXE
PID 1648 wrote to memory of 2088	1648	powershell.exe	rundll32.exe
PID 1648 wrote to memory of 2088	1648	powershell.exe	rundll32.exe

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\notice.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:4524

memory/1648-130-0x000001D33A0B0000-0x000001D33A0D2000-memory.dmp

Filesize
136KB

Download
memory/1648-131-0x00007FFE58640000-0x00007FFE59101000-memory.dmp

Filesize
10.8MB

Download
memory/1648-134-0x00007FFE58640000-0x00007FFE59101000-memory.dmp

Filesize
10.8MB

Download
memory/2088-133-0x0000000000000000-mapping.dmp

Download
memory/2088-135-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/4524-132-0x0000000000000000-mapping.dmp

Download