Overview

overview

10

Static

static

core/cmd.bat

windows7_x64

10

core/cmd.bat

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    18-02-2022 17:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    core/cmd.bat

Score
10/10
icedid3560182600bankercollectionspywarestealertrojan

Malware Config

Extracted

Family

icedid

rsa_pubkey.plain

Extracted

Family

icedid

Botnet

3560182600

C2

coolbearblunts.com

cooldogblunts.com
Attributes
  • auth_var

    2

  • url_path

    /news/

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 7 IoCs
    collection
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Discovers systems in the same network 1 TTPs 2 IoCs
    discovery
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 51 IoCs
  • Modifies registry class 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core\cmd.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2136
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\pudding-.dat,DllMain --ma="license.dat"
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Accesses Microsoft Outlook profiles
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:400
      • C:\Windows\system32\cmd.exe
        cmd.exe /c chcp >&2
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3564
        • C:\Windows\system32\chcp.com
          chcp
          4⤵
            PID:3548
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List
          3⤵
            PID:3520
          • C:\Windows\system32\ipconfig.exe
            ipconfig /all
            3⤵
            • Gathers network information
            PID:312
          • C:\Windows\system32\systeminfo.exe
            systeminfo
            3⤵
            • Gathers system information
            PID:1120
          • C:\Windows\system32\net.exe
            net config workstation
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2112
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 config workstation
              4⤵
                PID:3300
            • C:\Windows\system32\nltest.exe
              nltest /domain_trusts
              3⤵
                PID:1692
              • C:\Windows\system32\nltest.exe
                nltest /domain_trusts /all_trusts
                3⤵
                  PID:3512
                • C:\Windows\system32\net.exe
                  net view /all /domain
                  3⤵
                  • Discovers systems in the same network
                  PID:2628
                • C:\Windows\system32\net.exe
                  net view /all
                  3⤵
                  • Discovers systems in the same network
                  PID:3560
                • C:\Windows\system32\net.exe
                  net group "Domain Admins" /domain
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:388
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 group "Domain Admins" /domain
                    4⤵
                      PID:1472
              • C:\Windows\system32\MusNotifyIcon.exe
                %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
                1⤵
                • Checks processor information in registry
                PID:3332
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k NetworkService -p
                1⤵
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                PID:3108
              • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                1⤵
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                PID:2200

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/400-131-0x00000232449D0000-0x0000023244A29000-memory.dmp

                Filesize

                356KB

                Download

              • memory/400-132-0x0000023242C90000-0x0000023242C95000-memory.dmp

                Filesize

                20KB

                Download