icedid | 869e8b742394a505f495ce94d01782d58b9afc7327940a2accf2042fc0972b83

Analysis

Target

core.bat
Size

188B
MD5

1bc88881c82f35426e48f27de5c98003
SHA1

766fb820b706f21dd3d37efac8e937daf485d9f7
SHA256

eec0e5a1a8a21e713fe480883a9869a894c80a409ea06929de805e05c1ee14d6
SHA512

5c1d72bf225d8d07141b52cfcf22f13f8e2d0c34b6ed22d0adc6e68b3cf767ff54415c7178a8f6db2e66e819f28285cf9d1680777285138f7f8b08a83d8fa009

Score

10^/10

Family

icedid

Botnet

3036889562

stooryallice.com

yellowpyrrol.com

roomdetect.com

environmentbest.top

Attributes

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

32 1472 rundll32.exe
34 1472 rundll32.exe
36 1472 rundll32.exe
38 1472 rundll32.exe
40 1472 rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 1016 wrote to memory of 1472 1016 cmd.exe rundll32.exe
PID 1016 wrote to memory of 1472 1016 cmd.exe rundll32.exe

description	pid	process	target process
PID 1016 wrote to memory of 1472	1016	cmd.exe	rundll32.exe
PID 1016 wrote to memory of 1472	1016	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1016

C:\Users\Admin\AppData\Roaming\license.dat
MD5
e9ad8fae2dd8f9d12e709af20d9aefad

SHA1
db7d1545c3c7e60235700af672c1d20175b380cd

SHA256
84f016ece77ddd7d611ffc0cbb2ce24184aeee3a2fdbb9d44d0837bc533ba238

SHA512
4f652b4d2db81bd91e8a9cd8ca330748f7c98b21150ca2b640da2aad357adadeac80070177f9f253c595d683264d23e1f04701c2975c0e03caffd367d424d17f

Download Submit
memory/1472-130-0x0000000000000000-mapping.dmp

Download
memory/1472-131-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download
memory/1472-136-0x000001874E340000-0x000001874E39A000-memory.dmp

Filesize
360KB

Download