icedid | 87502ec6bc99fdad2d6092b022d35446123fd00e8ab9b5831939d32b7ba5a4de

Analysis

Target

UFbjRkMGfw.ps1
Size

59B
MD5

219543beb2dbd3dd4a38133cb4cf5d62
SHA1

a9f3bca1e95a8013e54a327ab471fa90f4d6fdec
SHA256

ff4878fee00d54134fffa5ca90af7ec4892d7397dafe5ad8a319ab83f9b594ae
SHA512

adfc8567036636ebcbd46d860eacdf55edaff7a56af5a65f0c4695fe2698fa8bc5c7afa1b75126450417516851b500bb3b8d1a1211dae279d6ef95c1621aab26

Score

10^/10

Family

icedid

Campaign

1842176049

carismortht.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

14 5016 rundll32.exe
Modifies registry class 1 IoCs

Processes:

powershell.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings powershell.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2660 NOTEPAD.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exerundll32.exe

pid process

5060 powershell.exe
5060 powershell.exe
5016 rundll32.exe
5016 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 5060 powershell.exe

flow	pid	process
14	5016	rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	powershell.exe

pid	process
2660	NOTEPAD.EXE

description	pid	process
Token: SeDebugPrivilege	5060	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 5060 wrote to memory of 2660	5060	powershell.exe	NOTEPAD.EXE
PID 5060 wrote to memory of 2660	5060	powershell.exe	NOTEPAD.EXE
PID 5060 wrote to memory of 5016	5060	powershell.exe	rundll32.exe
PID 5060 wrote to memory of 5016	5060	powershell.exe	rundll32.exe

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\notice.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:2660

memory/2660-132-0x0000000000000000-mapping.dmp

Download
memory/5016-133-0x0000000000000000-mapping.dmp

Download
memory/5016-135-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/5060-130-0x000002A8CB090000-0x000002A8CB0B2000-memory.dmp

Filesize
136KB

Download
memory/5060-131-0x00007FFB7CEF0000-0x00007FFB7D9B1000-memory.dmp

Filesize
10.8MB

Download
memory/5060-134-0x00007FFB7CEF0000-0x00007FFB7D9B1000-memory.dmp

Filesize
10.8MB

Download