Resubmissions

22-02-2022 16:11

220222-tnddmsahb8 10

19-01-2022 18:29

220119-w5ap7accep 10

Analysis

  • max time kernel
    151s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    22-02-2022 16:11

General

  • Target

    core.bat

  • Size

    190B

  • MD5

    5643357071a13383cebbfba6badd3f5c

  • SHA1

    73489b25328d8ccf3e6a3d4e9875053f42aec325

  • SHA256

    d0f5468b19c1f1a8fc73ce4ff44543bb6806c6e4061420c91913d8de89eca022

  • SHA512

    89d780d4f900f49e9b3987924f9e3439b2f500af41a085f612a64e78b7452b89c9b110c563e514b9c484730a509b84e4ea568d58193f325f66a500c6db969f61

Malware Config

Extracted

Family

icedid

rsa_pubkey.plain

Extracted

Family

icedid

Botnet

3415411565

C2

antnosience.com

seaskysafe.com

Attributes
  • auth_var

    1

  • url_path

    /news/

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Blocklisted process makes network request 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1548
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\scorpionx64.tmp,DllMain /i="license.dat"
      2⤵
      • Blocklisted process makes network request
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:1136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\license.dat
    MD5

    c7c45636ca690acdab7fba1e9d126f8b

    SHA1

    61376304cd90786813a80680a92cef03fedb6484

    SHA256

    cfc202b44509f2f607d365858a8218dfdc6b26f8087efcc5e46f4fef9ab53705

    SHA512

    9e6c7df9f70017b9eeb5868a358bc9eaf50de65dad04640220f380ff72e80bc303f034cb62929abb0c35d951b751732a131ae828c4c01cd1826610423f784db8

  • memory/1136-56-0x0000000001B20000-0x0000000001B79000-memory.dmp
    Filesize

    356KB

  • memory/1136-57-0x0000000000290000-0x00000000002C7000-memory.dmp
    Filesize

    220KB