icedid | 53ae67abfc5065a0a7a9d1e7045d06496dc7aa7c6eabd851514a457d3e7f0e61

Target

core.bat
Size

184B
MD5

58bf5ed00d983d8269d9f2e31e6586e8
SHA1

664e4ea375e9066d82e7d3baa167f0bb024a7c1f
SHA256

22adba0cadd8772ecf2190561fe86e9ad8609b01783a90c8f9635fd1dcba872c
SHA512

68688d606733f4844fcaeff76b7b3577739b008ba8fd93f28b23999a81f42ae417938245bd9f620c15161ec085dd3de7b51c016526ea3109dcbb142f0f5cdc14

Score

10^/10

Malware Config

Family

icedid

rsa_pubkey.plain

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

3 1888 rundll32.exe

flow	pid	process
3	1888	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 964 wrote to memory of 1888	964	cmd.exe	rundll32.exe
PID 964 wrote to memory of 1888	964	cmd.exe	rundll32.exe
PID 964 wrote to memory of 1888	964	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\grunt_64.tmp,DllMain /i="license.dat"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1888

C:\Users\Admin\AppData\Roaming\license.dat

MD5
7eb64145636d2e8343d9077f15c11022

SHA1
c0b221ca05431092bc1c789a33d199124c8fec1c

SHA256
96e657e1face63798a43e6210dba8d8c2f618d0be1230b95ab59d8bd23fc165a

SHA512
53171e09d3d146fe02e481944e1c5481f1bb48eaf66259d1b8bbbbf7a83efc4a73fc28089c7e1eacf221620cdff6ea7f1049c17720181fde88b4bdc27c1ea9b6

Download Submit
memory/1888-54-0x0000000000470000-0x00000000004C9000-memory.dmp

Filesize
356KB

Download
memory/1888-55-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download