icedid | e903d91fbb20cdc5aa801a6e8e6908c3d5611afb7415942a5b15f2c6871afceb

General

Target

core/cmd.bat

Score

10^/10

icedid 3560182600 banker trojan

Malware Config

Extracted

Family

icedid

rsa_pubkey.plain

Extracted

Family

icedid

Botnet

3560182600

C2

coolbearblunts.com

cooldogblunts.com

Attributes

auth_var
2
url_path
/news/

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

3 1312 rundll32.exe
5 1312 rundll32.exe

flow	pid	process
3	1312	rundll32.exe
5	1312	rundll32.exe

Modifies registry class 2 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\CLSID\{141D9F6A-53E5-D7D5-12B0-1F58181F69EC}	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\CLSID\{141D9F6A-53E5-D7D5-12B0-1F58181F69EC}\ = 383c55d609153509f9742f1c4a75fcf4bdeb12294b265eb82e1f03e2f111b2b106a93e15f2e2d2440dc6b4b1f345ca96eee30715402a3553598527e9f34b9daa6bb9ff62acb8d50d226511ef817225b5ba5011b1dacd27b06bc1a3afe35879726d8d62d1fe37e2668833584fc38d49b42f77cad30b3a50a13cf91610c439369efeebe0ee60e45ca1f8fd72bf1c66a715ea74a512763609cb07e5b77eb905feb41f575b5adf1afa237e920059c000eef676bf9f3bd59606a1fffd707c504621cccbfbc57c	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1628 wrote to memory of 1312	1628	cmd.exe	rundll32.exe
PID 1628 wrote to memory of 1312	1628	cmd.exe	rundll32.exe
PID 1628 wrote to memory of 1312	1628	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\core\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\pudding-.dat,DllMain --ma="license.dat"
  2⤵
  - Blocklisted process makes network request
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\license.dat

MD5
7eb64145636d2e8343d9077f15c11022

SHA1
c0b221ca05431092bc1c789a33d199124c8fec1c

SHA256
96e657e1face63798a43e6210dba8d8c2f618d0be1230b95ab59d8bd23fc165a

SHA512
53171e09d3d146fe02e481944e1c5481f1bb48eaf66259d1b8bbbbf7a83efc4a73fc28089c7e1eacf221620cdff6ea7f1049c17720181fde88b4bdc27c1ea9b6

Download Submit
memory/1312-56-0x0000000001B20000-0x0000000001B79000-memory.dmp

Filesize
356KB

Download
memory/1312-57-0x00000000001B0000-0x00000000001B5000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads