icedid | cb36a1d799acc290f4152471f539c5dc443dac0ba6d46c402ed86a1b5257db0c

Analysis

Target

core/cmd.bat
Size

191B
MD5

3cec7da4286fb8df01a057c04cc16b34
SHA1

be35d3e4fd882a807495f1dec189d09324b79612
SHA256

9eab93f08e471564ec1512005abb8e055119eefa66d12296487351e546aeb56c
SHA512

4d026d0dddf21aa105c9c0b45f791c5651c7dffb89701bf52fb71c7954648687f1be996d30c48ebe923794aeec31730f3dedb4df2e69b70c72f8dce0ed4d8d00

Score

10^/10

Family

icedid

Botnet

3415411565

antnosience.com

seaskysafe.com

otectagain.top

dilimoretast.com

Attributes

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

28 784 rundll32.exe
29 784 rundll32.exe
31 784 rundll32.exe
33 784 rundll32.exe
35 784 rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 3840 wrote to memory of 784 3840 cmd.exe rundll32.exe
PID 3840 wrote to memory of 784 3840 cmd.exe rundll32.exe

description	pid	process	target process
PID 3840 wrote to memory of 784	3840	cmd.exe	rundll32.exe
PID 3840 wrote to memory of 784	3840	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3840

C:\Users\Admin\AppData\Roaming\license.dat
MD5
e9ad8fae2dd8f9d12e709af20d9aefad

SHA1
db7d1545c3c7e60235700af672c1d20175b380cd

SHA256
84f016ece77ddd7d611ffc0cbb2ce24184aeee3a2fdbb9d44d0837bc533ba238

SHA512
4f652b4d2db81bd91e8a9cd8ca330748f7c98b21150ca2b640da2aad357adadeac80070177f9f253c595d683264d23e1f04701c2975c0e03caffd367d424d17f

Download Submit
memory/784-130-0x0000000000000000-mapping.dmp

Download
memory/784-131-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download
memory/784-136-0x000002BAC4840000-0x000002BAC489A000-memory.dmp

Filesize
360KB

Download