icedid | 293faad0e341c3fd59e0c668e98a4289f07b8b2f862e1d9ffabbbdd718b42fb8

General

Target

core/cmd.bat
Size

188B
MD5

2e2b47ce11618a88fdf41c2215ac0df6
SHA1

acb49181de3711e7cb0136033b53f7d0c628614a
SHA256

206adcd9c6879f5033e7395c523444430c90532675ac149b3434c84115ea95c3
SHA512

e8aef9395943d5e21904df89c7d44d4da6fe686ea31c3f61851efd5cd476bb524a29ccf47e884ffd4305ebc032df1057e9f7a786901a5f7f58f79e5fefcba4e5

Score

10^/10

icedid 987543880 banker trojan

Malware Config

Extracted

Family

icedid

Botnet

987543880

C2

fimlubindu.top

vindurualeg.top

bigcostarikas.top

extrimefigim.top

Attributes

url_path
/news/

Extracted

Family

icedid

rsa_pubkey.plain

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

5 2032 rundll32.exe
7 2032 rundll32.exe

flow	pid	process
5	2032	rundll32.exe
7	2032	rundll32.exe

Modifies registry class 2 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\CLSID\{E6AB5750-EA5C-083E-FBB2-6959D4C53546}	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\CLSID\{E6AB5750-EA5C-083E-FBB2-6959D4C53546}\ = cc972e0fb325e28718eafe75f0629203e3d2d94707567e959955eee2bf62dad3d52502fd9e961205d5018e0d8c68dc7c03b40b8eda7cd838119eaa798c0309ba461a5353a87ac2db983067b7ba0451e56505a75ecd5f948fb24fa5ea865630a7b28cd18855bef03e15301e157de2e820b61028a2f261b2761602fe161926e22ed49681bf0f38ea486331dc83ae187220551c868ea18cef8a9338cfcdf8c594b69107f3be2968d3095aca98255f5525cd8b18a1e8fd6d7c50c6e16c7bb369de9bb88ab2df58af66a380af91ae03450158c519a6f774aa00a19618b5077aab8177148df4ed7cbf1d603eca8cfed4354aa75f623f465e04a76389	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe
2032	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1360 wrote to memory of 2032	1360	cmd.exe	rundll32.exe
PID 1360 wrote to memory of 2032	1360	cmd.exe	rundll32.exe
PID 1360 wrote to memory of 2032	1360	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\core\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\play-x64.dat,update /i:"license.dat"
2⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\license.dat
MD5
3c6263a9c4117c78d26fc4380af014f2

SHA1
eca410dd57af16227220e08067c1895c258eb92b

SHA256
29d2a8344bd725d7a8b43cc77a82b3db57a5226ce792ac4b37e7f73ec468510e

SHA512
0969cde0d327b9f4b2be708437aea2a1d7a9ba9482125e143ce25c6a2f07e8ee1fa9b23e12f4e88157305f59209e2a8b3a2b2e7eb143b114e3f0c95ba57a2e1a

Download Submit
memory/2032-59-0x0000000000000000-mapping.dmp

Download
memory/2032-60-0x00000000002B0000-0x00000000002B5000-memory.dmp

Filesize
20KB

Download
memory/2032-63-0x00000000004D0000-0x0000000000528000-memory.dmp

Filesize
352KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads