icedid | 6325b863f21d53e98a808e05d83a18740b969b9101698e66d2041fad6b392e36

Analysis

Target

core.bat
Size

182B
MD5

1c494d1c28af9cac5e1c26f9b9f79ce6
SHA1

fa138fdb8e22df8c6c04fefbfcc53be7bb20d017
SHA256

ae1821dda2a90fe35076771f7ea8619c4be1f3a7f2ec743875b016ba1f29ca4e
SHA512

bedd23fc38ee62a807933a850454de53d6ea1ef96c4d9758d69cf7695a58cddce357066773f91ee363b6743804ac1a8c23986b9dc9ad92c75afac482f5cfa415

Score

10^/10

Family

icedid

rsa_pubkey.plain

Family

icedid

Botnet

3560182600

coolbearblunts.com

cooldogblunts.com

Attributes

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

48 1420 rundll32.exe
51 1420 rundll32.exe

flow	pid	process
48	1420	rundll32.exe
51	1420	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 900 wrote to memory of 1420 900 cmd.exe rundll32.exe
PID 900 wrote to memory of 1420 900 cmd.exe rundll32.exe

description	pid	process	target process
PID 900 wrote to memory of 1420	900	cmd.exe	rundll32.exe
PID 900 wrote to memory of 1420	900	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:900

C:\Users\Admin\AppData\Roaming\license.dat
MD5
7eb64145636d2e8343d9077f15c11022

SHA1
c0b221ca05431092bc1c789a33d199124c8fec1c

SHA256
96e657e1face63798a43e6210dba8d8c2f618d0be1230b95ab59d8bd23fc165a

SHA512
53171e09d3d146fe02e481944e1c5481f1bb48eaf66259d1b8bbbbf7a83efc4a73fc28089c7e1eacf221620cdff6ea7f1049c17720181fde88b4bdc27c1ea9b6

Download Submit
memory/1420-131-0x00000225719C0000-0x0000022571A19000-memory.dmp

Filesize
356KB

Download
memory/1420-132-0x00000225719A0000-0x00000225719A5000-memory.dmp

Filesize
20KB

Download