icedid | 1938b54b768ab26cfd65aa00e9735c25eac7406a0ac7e2974bd02e88ee1ba9fc

Resubmissions

22-02-2022 16:12

06-01-2022 15:26

Target

core.bat
Size

180B
MD5

92ab94157586e3937dcfd7aaa380a7fb
SHA1

74a326efc3c891877a8d2657d8a2fe3e37f059f7
SHA256

dc74ad702adf3a1d49a4070915ffbd1b445c8f0ecfa42357a74380e34793f61d
SHA512

44a54970a090f43c9dfa1865a0df0d5513cf3836d656f57a4c54d53847d8ada7e71265b53422ab7acbe1781a45742d8bbaa256cc275b514cbd773850cfadb77f

Score

10^/10

Family

icedid

rsa_pubkey.plain

Family

icedid

Botnet

4103365356

upperdown.eu

upperdown.in

landofrayz.com

Attributes

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

61 3800 rundll32.exe
63 3800 rundll32.exe
68 3800 rundll32.exe
71 3800 rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 884 wrote to memory of 3800 884 cmd.exe rundll32.exe
PID 884 wrote to memory of 3800 884 cmd.exe rundll32.exe

description	pid	process	target process
PID 884 wrote to memory of 3800	884	cmd.exe	rundll32.exe
PID 884 wrote to memory of 3800	884	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\surge-.dat,DllMain /i="license.dat"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3800

C:\Users\Admin\AppData\Roaming\license.dat

MD5
c7c45636ca690acdab7fba1e9d126f8b

SHA1
61376304cd90786813a80680a92cef03fedb6484

SHA256
cfc202b44509f2f607d365858a8218dfdc6b26f8087efcc5e46f4fef9ab53705

SHA512
9e6c7df9f70017b9eeb5868a358bc9eaf50de65dad04640220f380ff72e80bc303f034cb62929abb0c35d951b751732a131ae828c4c01cd1826610423f784db8

Download Submit
memory/3800-131-0x000001BE21C80000-0x000001BE21CD9000-memory.dmp

Filesize
356KB

Download
memory/3800-132-0x000001BE20000000-0x000001BE20037000-memory.dmp

Filesize
220KB

Download