icedid | 9424e361d1fff5dd475b78a0436413a0ba022d3e4e0d13967bf7a27362f3a144

Analysis

Target

core.bat
Size

184B
MD5

4766e3cd2f4eb06fd1563a3dd3a7704f
SHA1

cdb45f46f51bce83cedf8bbd1b7be775d32bad60
SHA256

61ad4c75614d2a61ffb2423125d87b56eab3bfe3046f4c41e7ce402b3e512ed2
SHA512

4d4c8409cb662989c1ef490291b959928a2a5ac4e98cde4106ea6a0ea1eb8b055603edfa136bb4c0ceacb4bc651ab557eddfb9731a5776290d2e7669b7838a4c

Score

10^/10

Family

icedid

Botnet

273095221

loniferast.top

hoseonlin.top

fallhuma.top

nefitsonyo.xyz

Attributes

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

3 1808 rundll32.exe
5 1808 rundll32.exe
7 1808 rundll32.exe
9 1808 rundll32.exe
11 1808 rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1672 wrote to memory of 1808	1672	cmd.exe	rundll32.exe
PID 1672 wrote to memory of 1808	1672	cmd.exe	rundll32.exe
PID 1672 wrote to memory of 1808	1672	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672

C:\Users\Admin\AppData\Roaming\license.dat
MD5
e9ad8fae2dd8f9d12e709af20d9aefad

SHA1
db7d1545c3c7e60235700af672c1d20175b380cd

SHA256
84f016ece77ddd7d611ffc0cbb2ce24184aeee3a2fdbb9d44d0837bc533ba238

SHA512
4f652b4d2db81bd91e8a9cd8ca330748f7c98b21150ca2b640da2aad357adadeac80070177f9f253c595d683264d23e1f04701c2975c0e03caffd367d424d17f

Download Submit
memory/1808-54-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download
memory/1808-59-0x00000000002B0000-0x000000000030A000-memory.dmp

Filesize
360KB

Download