icedid | 34948d0d4911eca35482764310f560be97ca33ebce759a479f7733c10c86dd8b

Analysis

Target

cmd.bat
Size

69B
MD5

5e9549ff24e0488d40f20979c9e9c6e4
SHA1

271430ffb14345fd1ed91d8339b60103979de8e6
SHA256

2465269b1d190d38aa49ed7d70429f7d5bb2688806f932d69ae43d3a58f7854b
SHA512

963ec4155f664a14f36690a2846ccdac42d62401e3397582cbe1022152e033a9e118e5af2d4618181b6fc974659e980c4894b6d5305ae925c604969905459840

Score

10^/10

Family

icedid

Campaign

3000901376

yolneanz.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

6 4808 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4808 rundll32.exe
4808 rundll32.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 2460 wrote to memory of 4808 2460 cmd.exe rundll32.exe
PID 2460 wrote to memory of 4808 2460 cmd.exe rundll32.exe

flow	pid	process
6	4808	rundll32.exe

pid	process
4808	rundll32.exe
4808	rundll32.exe

description	pid	process	target process
PID 2460 wrote to memory of 4808	2460	cmd.exe	rundll32.exe
PID 2460 wrote to memory of 4808	2460	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cmd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460

memory/4808-130-0x0000000000000000-mapping.dmp

Download
memory/4808-131-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download