icedid | 34948d0d4911eca35482764310f560be97ca33ebce759a479f7733c10c86dd8b

Analysis

Target

cmd.bat
Size

69B
MD5

5e9549ff24e0488d40f20979c9e9c6e4
SHA1

271430ffb14345fd1ed91d8339b60103979de8e6
SHA256

2465269b1d190d38aa49ed7d70429f7d5bb2688806f932d69ae43d3a58f7854b
SHA512

963ec4155f664a14f36690a2846ccdac42d62401e3397582cbe1022152e033a9e118e5af2d4618181b6fc974659e980c4894b6d5305ae925c604969905459840

Score

10^/10

Family

icedid

Campaign

3000901376

yolneanz.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1668 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1668 rundll32.exe
1668 rundll32.exe

flow	pid	process
2	1668	rundll32.exe

pid	process
1668	rundll32.exe
1668	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1660 wrote to memory of 1668	1660	cmd.exe	rundll32.exe
PID 1660 wrote to memory of 1668	1660	cmd.exe	rundll32.exe
PID 1660 wrote to memory of 1668	1660	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660

memory/1668-54-0x0000000000000000-mapping.dmp

Download
memory/1668-55-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download