icedid | 59615b1fa43f785fe4cec58d44c5eaa47961e308117ffd4b5c3e9554ad29c1fc

Resubmissions

22-02-2022 16:12

03-01-2022 11:01

Target

core.bat
Size

188B
MD5

516bf69f7095a20782228e6694bdeddc
SHA1

e28ab3207ed45a94cbdbd614aeea0c4d4e735dcd
SHA256

5b122305b77821f70a0e95d0f7cbe5890e4c9062e05e72fd506877c7523d468b
SHA512

b8463b7cdcb686816a3952eec8aa2be0b1a78c777331b27a91aa10190a2a9d2c1a7bb6920ab09e15f46a495047fa4cb02883a8a22a942984f3b46096899394a4

Score

10^/10

Family

icedid

rsa_pubkey.plain

Family

icedid

Botnet

3106999479

balliordan.com

oprenfirst.com

loremurs.com

Attributes

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

64 4016 rundll32.exe
66 4016 rundll32.exe
69 4016 rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 4020 wrote to memory of 4016 4020 cmd.exe rundll32.exe
PID 4020 wrote to memory of 4016 4020 cmd.exe rundll32.exe

description	pid	process	target process
PID 4020 wrote to memory of 4016	4020	cmd.exe	rundll32.exe
PID 4020 wrote to memory of 4016	4020	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4020

C:\Users\Admin\AppData\Roaming\license.dat

MD5
c7c45636ca690acdab7fba1e9d126f8b

SHA1
61376304cd90786813a80680a92cef03fedb6484

SHA256
cfc202b44509f2f607d365858a8218dfdc6b26f8087efcc5e46f4fef9ab53705

SHA512
9e6c7df9f70017b9eeb5868a358bc9eaf50de65dad04640220f380ff72e80bc303f034cb62929abb0c35d951b751732a131ae828c4c01cd1826610423f784db8

Download Submit
memory/4016-131-0x00000232FE860000-0x00000232FE8B9000-memory.dmp

Filesize
356KB

Download
memory/4016-132-0x00000232FCF60000-0x00000232FCF65000-memory.dmp

Filesize
20KB

Download