Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
25-05-2021 22:27
Static task
static1
Behavioral task
behavioral1
Sample
core/cmd.bat
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Malware Config
Extracted
Family
icedid
rsa_pubkey.plain
Extracted
Family
icedid
Botnet
987543880
C2
fimlubindu.top
vindurualeg.top
esaquell.website
extrimefigim.top
Attributes
-
url_path
/news/
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe 1524 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1456 wrote to memory of 1524 1456 cmd.exe 74 PID 1456 wrote to memory of 1524 1456 cmd.exe 74
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core\cmd.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\core\childx64.bin,update /i:"license.dat"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1524
-