icedid | ebd821b85532d1e09858188467ec143c62a463098d2eaeb3e613ecbce8b18d6a

General

Target

core.bat
Size

188B
MD5

a1550b458ee5d98525dbdb544cb3a183
SHA1

a0672371da258190c2b4bc6aade702ee8db4a23c
SHA256

933793ba688465b30736a07fc9505a49c0a0053d88dc96ad8d5aa3e29a8768de
SHA512

91422eafa8072bd02d3ea371cfd0bd6570151f9eb9506649c3fd38175652be63921e0c6f125dd66771e66125b014a2cff3bdac63f40a33ab284dff81ed0ab061

Score

10^/10

icedid banker trojan

Malware Config

Extracted

Family

icedid

rsa_pubkey.plain

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

29 2504 rundll32.exe
32 2504 rundll32.exe
33 2504 rundll32.exe
Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Discovers systems in the same network 1 TTPs 2 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exenet.exe

pid process

1484 net.exe
1876 net.exe
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exe

pid process

980 ipconfig.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

1124 systeminfo.exe

flow	pid	process
29	2504	rundll32.exe
32	2504	rundll32.exe
33	2504	rundll32.exe

pid	process
1484	net.exe
1876	net.exe

pid	process
980	ipconfig.exe

pid	process
1124	systeminfo.exe

Modifies registry class 2 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\CLSID\{3CDA2A5B-5680-148B-E898-8943AAE85371}\ = a825bfb4389e73bcda98674e38d23d663b9c7c20efcee6ca4abac2131f8033f9e878f00a0a72e3c27c68619551682a9315df7d19b608cb015945bada1ca95c57bdb8fa1a4f8b8eba732d81db7f7432e2f131c6a75cfd9f5aa3da1e49c3f2f1652a53c819cd4a60b22946dbc7422ece73d2727afdad24d1a88002273f9c9f409af366a983bdc16d8a79b11167374ec3872cddce81a014adf5e86ba40f2d482dc01c7c28c356a5b678ba9d2fcf8711e06ebb91aa8859742bd63820d391017c73bf6763ae85bd0838ea48ebf0f16ebe14e66222de06515c05d99da68ba4ca87af9702fcb31f575bda1f7a2a0b82c42658d2e176b71476a114a66cbf8ced9598b310c540811051	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\CLSID\{3CDA2A5B-5680-148B-E898-8943AAE85371}	rundll32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

WMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	728	WMIC.exe
Token: SeSecurityPrivilege	728	WMIC.exe
Token: SeTakeOwnershipPrivilege	728	WMIC.exe
Token: SeLoadDriverPrivilege	728	WMIC.exe
Token: SeSystemProfilePrivilege	728	WMIC.exe
Token: SeSystemtimePrivilege	728	WMIC.exe
Token: SeProfSingleProcessPrivilege	728	WMIC.exe
Token: SeIncBasePriorityPrivilege	728	WMIC.exe
Token: SeCreatePagefilePrivilege	728	WMIC.exe
Token: SeBackupPrivilege	728	WMIC.exe
Token: SeRestorePrivilege	728	WMIC.exe
Token: SeShutdownPrivilege	728	WMIC.exe
Token: SeDebugPrivilege	728	WMIC.exe
Token: SeSystemEnvironmentPrivilege	728	WMIC.exe
Token: SeRemoteShutdownPrivilege	728	WMIC.exe
Token: SeUndockPrivilege	728	WMIC.exe
Token: SeManageVolumePrivilege	728	WMIC.exe
Token: 33	728	WMIC.exe
Token: 34	728	WMIC.exe
Token: 35	728	WMIC.exe
Token: 36	728	WMIC.exe
Token: SeIncreaseQuotaPrivilege	728	WMIC.exe
Token: SeSecurityPrivilege	728	WMIC.exe
Token: SeTakeOwnershipPrivilege	728	WMIC.exe
Token: SeLoadDriverPrivilege	728	WMIC.exe
Token: SeSystemProfilePrivilege	728	WMIC.exe
Token: SeSystemtimePrivilege	728	WMIC.exe
Token: SeProfSingleProcessPrivilege	728	WMIC.exe
Token: SeIncBasePriorityPrivilege	728	WMIC.exe
Token: SeCreatePagefilePrivilege	728	WMIC.exe
Token: SeBackupPrivilege	728	WMIC.exe
Token: SeRestorePrivilege	728	WMIC.exe
Token: SeShutdownPrivilege	728	WMIC.exe
Token: SeDebugPrivilege	728	WMIC.exe
Token: SeSystemEnvironmentPrivilege	728	WMIC.exe
Token: SeRemoteShutdownPrivilege	728	WMIC.exe
Token: SeUndockPrivilege	728	WMIC.exe
Token: SeManageVolumePrivilege	728	WMIC.exe
Token: 33	728	WMIC.exe
Token: 34	728	WMIC.exe
Token: 35	728	WMIC.exe
Token: 36	728	WMIC.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

cmd.exerundll32.execmd.exenet.exenet.exe

description	pid	process	target process
PID 912 wrote to memory of 2504	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 2504	912	cmd.exe	rundll32.exe
PID 2504 wrote to memory of 3592	2504	rundll32.exe	cmd.exe
PID 2504 wrote to memory of 3592	2504	rundll32.exe	cmd.exe
PID 3592 wrote to memory of 620	3592	cmd.exe	chcp.com
PID 3592 wrote to memory of 620	3592	cmd.exe	chcp.com
PID 2504 wrote to memory of 728	2504	rundll32.exe	WMIC.exe
PID 2504 wrote to memory of 728	2504	rundll32.exe	WMIC.exe
PID 2504 wrote to memory of 980	2504	rundll32.exe	ipconfig.exe
PID 2504 wrote to memory of 980	2504	rundll32.exe	ipconfig.exe
PID 2504 wrote to memory of 1124	2504	rundll32.exe	systeminfo.exe
PID 2504 wrote to memory of 1124	2504	rundll32.exe	systeminfo.exe
PID 2504 wrote to memory of 2520	2504	rundll32.exe	net.exe
PID 2504 wrote to memory of 2520	2504	rundll32.exe	net.exe
PID 2520 wrote to memory of 2204	2520	net.exe	net1.exe
PID 2520 wrote to memory of 2204	2520	net.exe	net1.exe
PID 2504 wrote to memory of 3036	2504	rundll32.exe	nltest.exe
PID 2504 wrote to memory of 3036	2504	rundll32.exe	nltest.exe
PID 2504 wrote to memory of 2868	2504	rundll32.exe	nltest.exe
PID 2504 wrote to memory of 2868	2504	rundll32.exe	nltest.exe
PID 2504 wrote to memory of 1484	2504	rundll32.exe	net.exe
PID 2504 wrote to memory of 1484	2504	rundll32.exe	net.exe
PID 2504 wrote to memory of 1876	2504	rundll32.exe	net.exe
PID 2504 wrote to memory of 1876	2504	rundll32.exe	net.exe
PID 2504 wrote to memory of 1712	2504	rundll32.exe	net.exe
PID 2504 wrote to memory of 1712	2504	rundll32.exe	net.exe
PID 1712 wrote to memory of 2956	1712	net.exe	net1.exe
PID 1712 wrote to memory of 2956	1712	net.exe	net1.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\relief-x64.dat,DllMain /i="license.dat"
2⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2504

C:\Windows\system32\cmd.exe
cmd.exe /c chcp >&2
3⤵
- Suspicious use of WriteProcessMemory
PID:3592

C:\Windows\system32\chcp.com
chcp
4⤵
PID:620

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:728

C:\Windows\system32\ipconfig.exe
ipconfig /all
3⤵
- Gathers network information
PID:980

C:\Windows\system32\systeminfo.exe
systeminfo
3⤵
- Gathers system information
PID:1124

C:\Windows\system32\net.exe
net config workstation
3⤵
- Suspicious use of WriteProcessMemory
PID:2520

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 config workstation
4⤵
PID:2204

C:\Windows\system32\nltest.exe
nltest /domain_trusts
3⤵
PID:3036

C:\Windows\system32\nltest.exe
nltest /domain_trusts /all_trusts
3⤵
PID:2868

C:\Windows\system32\net.exe
net view /all /domain
3⤵
- Discovers systems in the same network
PID:1484

C:\Windows\system32\net.exe
net view /all
3⤵
- Discovers systems in the same network
PID:1876

C:\Windows\system32\net.exe
net group "Domain Admins" /domain
3⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 group "Domain Admins" /domain
4⤵
PID:2956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\license.dat

MD5
c7c45636ca690acdab7fba1e9d126f8b

SHA1
61376304cd90786813a80680a92cef03fedb6484

SHA256
cfc202b44509f2f607d365858a8218dfdc6b26f8087efcc5e46f4fef9ab53705

SHA512
9e6c7df9f70017b9eeb5868a358bc9eaf50de65dad04640220f380ff72e80bc303f034cb62929abb0c35d951b751732a131ae828c4c01cd1826610423f784db8

Download Submit
memory/620-120-0x0000000000000000-mapping.dmp

Download
memory/728-121-0x0000000000000000-mapping.dmp

Download
memory/980-122-0x0000000000000000-mapping.dmp

Download
memory/1124-123-0x0000000000000000-mapping.dmp

Download
memory/1484-128-0x0000000000000000-mapping.dmp

Download
memory/1712-130-0x0000000000000000-mapping.dmp

Download
memory/1876-129-0x0000000000000000-mapping.dmp

Download
memory/2204-125-0x0000000000000000-mapping.dmp

Download
memory/2504-118-0x000002CC94110000-0x000002CC94147000-memory.dmp

Filesize
220KB

Download
memory/2504-117-0x000002CC94360000-0x000002CC943B9000-memory.dmp

Filesize
356KB

Download
memory/2504-115-0x0000000000000000-mapping.dmp

Download
memory/2520-124-0x0000000000000000-mapping.dmp

Download
memory/2868-127-0x0000000000000000-mapping.dmp

Download
memory/2956-131-0x0000000000000000-mapping.dmp

Download
memory/3036-126-0x0000000000000000-mapping.dmp

Download
memory/3592-119-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads