icedid | 887b4d1431f6193b1cd7fd5c15c4687ebcf2cbe7b2cecbbcf41260e401ebeeea

Analysis

Target

core.bat
Size

184B
MD5

d89cd3f80a0c0c1d6ef962509e593e88
SHA1

cd9835745e5c2170255c6e28f80b27482d37155b
SHA256

6799f0bb30fec071f472a8c71d85ac59c39e3f6d9e9901628fef5b8698f49fe1
SHA512

0dba4611d2750ceed996555cec347098853d51154335a45d3a828ff5ba50e34698fdfc2f8f48c22a8da4cd7077ae0a97b6b88ebbe55e4a814cfd036519cd9eaf

Score

10^/10

Family

icedid

Botnet

3415411565

antnosience.com

seaskysafe.com

otectagain.top

dilimoretast.com

Attributes

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

3 960 rundll32.exe
5 960 rundll32.exe
7 960 rundll32.exe
9 960 rundll32.exe
11 960 rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1056 wrote to memory of 960	1056	cmd.exe	rundll32.exe
PID 1056 wrote to memory of 960	1056	cmd.exe	rundll32.exe
PID 1056 wrote to memory of 960	1056	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Users\Admin\AppData\Roaming\license.dat
MD5
e9ad8fae2dd8f9d12e709af20d9aefad

SHA1
db7d1545c3c7e60235700af672c1d20175b380cd

SHA256
84f016ece77ddd7d611ffc0cbb2ce24184aeee3a2fdbb9d44d0837bc533ba238

SHA512
4f652b4d2db81bd91e8a9cd8ca330748f7c98b21150ca2b640da2aad357adadeac80070177f9f253c595d683264d23e1f04701c2975c0e03caffd367d424d17f

Download Submit
memory/960-54-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download
memory/960-59-0x00000000002B0000-0x000000000030A000-memory.dmp

Filesize
360KB

Download