icedid | 852d511a9276c1004efcdc148e70aecb973948389be1094cdbc850c4face77d6

Target

core.bat
Size

188B
MD5

5d557256208a36dcd239278ba626f30c
SHA1

1e54238d55ab57ab5e7b787d3f369d6a02374d2b
SHA256

26cfdedc156563695d6188240fa38ee5d3b29e468dee368facf66b8710eae3e2
SHA512

2cd8215e99f4d61035747670dd2109aa806fe4c505648982926bb1bd886eadf1da583823e019e8af34939531bf669b6ffb19a334f3c3e678c56a7f5ebe2745ad

Score

10^/10

Malware Config

Family

icedid

rsa_pubkey.plain

Family

icedid

Botnet

3560182600

coolbearblunts.com

cooldogblunts.com

Attributes

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

54 2452 rundll32.exe
56 2452 rundll32.exe
58 2452 rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 1852 wrote to memory of 2452 1852 cmd.exe rundll32.exe
PID 1852 wrote to memory of 2452 1852 cmd.exe rundll32.exe

description	pid	process	target process
PID 1852 wrote to memory of 2452	1852	cmd.exe	rundll32.exe
PID 1852 wrote to memory of 2452	1852	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\pumpkin-32.tmp,DllMain /i="license.dat"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:2452

C:\Users\Admin\AppData\Roaming\license.dat

MD5
7eb64145636d2e8343d9077f15c11022

SHA1
c0b221ca05431092bc1c789a33d199124c8fec1c

SHA256
96e657e1face63798a43e6210dba8d8c2f618d0be1230b95ab59d8bd23fc165a

SHA512
53171e09d3d146fe02e481944e1c5481f1bb48eaf66259d1b8bbbbf7a83efc4a73fc28089c7e1eacf221620cdff6ea7f1049c17720181fde88b4bdc27c1ea9b6

Download Submit
memory/2452-131-0x000002D330B20000-0x000002D330B79000-memory.dmp

Filesize
356KB

Download
memory/2452-132-0x000002D330B00000-0x000002D330B05000-memory.dmp

Filesize
20KB

Download