icedid | 81e1fa45f636b33fd145267c44ee8c157208c24ad88a1c1d6d7f4d8c1c18bee3

Analysis

Score

10^/10

Family

icedid

rsa_pubkey.plain

Family

icedid

Botnet

987543880

fimlubindu.top

vindurualeg.top

esaquell.website

extrimefigim.top

Attributes

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 1456 wrote to memory of 1524 1456 cmd.exe rundll32.exe
PID 1456 wrote to memory of 1524 1456 cmd.exe rundll32.exe

description	pid	process	target process
PID 1456 wrote to memory of 1524	1456	cmd.exe	rundll32.exe
PID 1456 wrote to memory of 1524	1456	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\childx64.bin,update /i:"license.dat"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1524

C:\Users\Admin\AppData\Roaming\license.dat
MD5
3c6263a9c4117c78d26fc4380af014f2

SHA1
eca410dd57af16227220e08067c1895c258eb92b

SHA256
29d2a8344bd725d7a8b43cc77a82b3db57a5226ce792ac4b37e7f73ec468510e

SHA512
0969cde0d327b9f4b2be708437aea2a1d7a9ba9482125e143ce25c6a2f07e8ee1fa9b23e12f4e88157305f59209e2a8b3a2b2e7eb143b114e3f0c95ba57a2e1a

Download Submit
memory/1524-114-0x0000000000000000-mapping.dmp

Download
memory/1524-116-0x00000220538C0000-0x0000022053918000-memory.dmp

Filesize
352KB

Download
memory/1524-117-0x0000022051D60000-0x0000022051DA1000-memory.dmp

Filesize
260KB

Download