icedid | e926ae4a601b8d3222cf205eb885428bc9242197e2fe2c81e059d4d83c9af860

General

Target

HDFcvLHBhKEQvBlli.ps1
Size

71B
MD5

d6c6fccc7b7f3856bdefb7069010bdcb
SHA1

9cceb8f815bf32e2d99b6379e8c18125ea3f7d3f
SHA256

6fe702cfd5b4f59fe4284caaf0c86c24c80b9e56ba9562c18e4961e9c88ff29d
SHA512

d0a22ea5d2c8cb7f57b479360a7a7227bd1897d5f211e0af2cf850bb7a547d7b847cc87957282dee2223e0211160e23dbda06747dfd44a9eec9eeadf602ccc02

Score

10^/10

Family

icedid

Campaign

1175749654

C2

hlansmagazine.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1628 rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exerundll32.exe

pid process

1864 powershell.exe
1864 powershell.exe
1864 powershell.exe
1628 rundll32.exe
1628 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1864 powershell.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1696 AcroRd32.exe
1696 AcroRd32.exe
1696 AcroRd32.exe

flow	pid	process
2	1628	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1864	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1864 wrote to memory of 1696	1864	powershell.exe	AcroRd32.exe
PID 1864 wrote to memory of 1696	1864	powershell.exe	AcroRd32.exe
PID 1864 wrote to memory of 1696	1864	powershell.exe	AcroRd32.exe
PID 1864 wrote to memory of 1696	1864	powershell.exe	AcroRd32.exe
PID 1864 wrote to memory of 1628	1864	powershell.exe	rundll32.exe
PID 1864 wrote to memory of 1628	1864	powershell.exe	rundll32.exe
PID 1864 wrote to memory of 1628	1864	powershell.exe	rundll32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Case.pdf"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1696

memory/1628-60-0x0000000000000000-mapping.dmp

Download
memory/1628-65-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1696-58-0x0000000000000000-mapping.dmp

Download
memory/1696-59-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1696-63-0x0000000002AD0000-0x0000000002B46000-memory.dmp

Filesize
472KB

Download
memory/1864-54-0x000007FEFBF91000-0x000007FEFBF93000-memory.dmp

Filesize
8KB

Download
memory/1864-55-0x000007FEF45D0000-0x000007FEF4FF3000-memory.dmp

Filesize
10.1MB

Download
memory/1864-56-0x000007FEF3A70000-0x000007FEF45CD000-memory.dmp

Filesize
11.4MB

Download
memory/1864-57-0x0000000002524000-0x0000000002527000-memory.dmp

Filesize
12KB

Download
memory/1864-61-0x0000000002524000-0x0000000002527000-memory.dmp

Filesize
12KB

Download
memory/1864-62-0x000000000252B000-0x000000000254A000-memory.dmp

Filesize
124KB

Download