Resubmissions

23-06-2021 14:18

210623-fa6mx24cr2 10

08-06-2021 15:18

210608-pctrrzna4n 10

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    23-06-2021 14:18

General

  • Target

    core/cmd.bat

  • Size

    188B

  • MD5

    18922a31adfef9144b9c68694a211b48

  • SHA1

    1e63fbb6511e15ba07f555c11b2a05d63e49b5a3

  • SHA256

    68867aec1fd8a6eb416081c747705e847de95c033f5b38eb57ea575c69397210

  • SHA512

    573349edbae1baf769457402c65670b9d76facec7c056010a7b2a556d433d9176418cd4a2a39dd04654c3c4216019d27d47e15a6c1fd4f4fdcc57d5f98664a4a

Malware Config

Extracted

Family

icedid

rsa_pubkey.plain

Extracted

Family

icedid

Botnet

987543880

C2

fimlubindu.top

vindurualeg.top

bigcostarikas.top

extrimefigim.top

Attributes
  • auth_var

    8

  • url_path

    /news/

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Blocklisted process makes network request 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\core\cmd.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:540
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\genre-64.dat,update /i:"license.dat"
      2⤵
      • Blocklisted process makes network request
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\license.dat
    MD5

    3c6263a9c4117c78d26fc4380af014f2

    SHA1

    eca410dd57af16227220e08067c1895c258eb92b

    SHA256

    29d2a8344bd725d7a8b43cc77a82b3db57a5226ce792ac4b37e7f73ec468510e

    SHA512

    0969cde0d327b9f4b2be708437aea2a1d7a9ba9482125e143ce25c6a2f07e8ee1fa9b23e12f4e88157305f59209e2a8b3a2b2e7eb143b114e3f0c95ba57a2e1a

  • memory/2004-60-0x0000000000000000-mapping.dmp
  • memory/2004-62-0x0000000001C80000-0x0000000001CD8000-memory.dmp
    Filesize

    352KB

  • memory/2004-63-0x0000000001C40000-0x0000000001C77000-memory.dmp
    Filesize

    220KB