icedid | daa40acf17585b2246dc1e9e6610964368f6fb854fdc16a1972c7908c23ab5cf

Analysis

Target

THjkgeCbhjm.ps1
Size

69B
MD5

c7f314e4db039ed46f95c7747d3ecec9
SHA1

3d448506d12a2274424bb24ef9519472fdd5285c
SHA256

caf8215e7e34ce4d16a2e1ee7ad3089bc815d243f84e8e8dffc190983cebc441
SHA512

ce20bea4d6692996b29a9c22e5deb04fe5aa186a5235ee213dd19bdb962bff8cf618feec912b06c66b76c3830f8a36179e371680c28d89e5a865518e28161fdf

Score

10^/10

Family

icedid

Campaign

1825398430

ciaontroni.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 856 rundll32.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1436 NOTEPAD.EXE
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exerundll32.exe

pid process

1520 powershell.exe
1520 powershell.exe
1520 powershell.exe
856 rundll32.exe
856 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1520 powershell.exe

flow	pid	process
2	856	rundll32.exe

pid	process
1436	NOTEPAD.EXE

description	pid	process
Token: SeDebugPrivilege	1520	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1520 wrote to memory of 1436	1520	powershell.exe	NOTEPAD.EXE
PID 1520 wrote to memory of 1436	1520	powershell.exe	NOTEPAD.EXE
PID 1520 wrote to memory of 1436	1520	powershell.exe	NOTEPAD.EXE
PID 1520 wrote to memory of 856	1520	powershell.exe	rundll32.exe
PID 1520 wrote to memory of 856	1520	powershell.exe	rundll32.exe
PID 1520 wrote to memory of 856	1520	powershell.exe	rundll32.exe

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\notice.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:1436

memory/856-61-0x0000000000000000-mapping.dmp

Download
memory/856-65-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1436-60-0x0000000000000000-mapping.dmp

Download
memory/1520-54-0x000007FEFBFD1000-0x000007FEFBFD3000-memory.dmp

Filesize
8KB

Download
memory/1520-55-0x000007FEF44C0000-0x000007FEF4EE3000-memory.dmp

Filesize
10.1MB

Download
memory/1520-57-0x0000000002924000-0x0000000002927000-memory.dmp

Filesize
12KB

Download
memory/1520-56-0x000007FEF3960000-0x000007FEF44BD000-memory.dmp

Filesize
11.4MB

Download
memory/1520-58-0x000000001B8B0000-0x000000001BBAF000-memory.dmp

Filesize
3.0MB

Download
memory/1520-59-0x000000000292B000-0x000000000294A000-memory.dmp

Filesize
124KB

Download
memory/1520-63-0x0000000002924000-0x0000000002927000-memory.dmp

Filesize
12KB

Download
memory/1520-64-0x000000000292B000-0x000000000294A000-memory.dmp

Filesize
124KB

Download