icedid | ebddaadbc63e606e1b6bafdc7f0089dc91a3789b772e3524d9ed3f8b4d0b7433

Analysis

Target

run.bat
Size

55B
MD5

a277e267f0e6ae54192b94dd79f9a9a9
SHA1

b76121f7cf012dc41729f7b7a6db869b1fb95ab7
SHA256

386dfbbd9246159b790559dc36588f4d2f9cdcf6642c1dcba6584424a11cc8fa
SHA512

fc060ed81566d976ffa8bbe1db8e0a8ff30cbc2ef16d3eefaecb27f010fe1b3539b72d0017bc1a77d6058cb1f47610b6a974c230ca1ed468ffc13de418394dc7

Score

10^/10

Family

icedid

Campaign

3585208491

bredofenction.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1108 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1108 rundll32.exe
1108 rundll32.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 1728 wrote to memory of 1108 1728 cmd.exe rundll32.exe
PID 1728 wrote to memory of 1108 1728 cmd.exe rundll32.exe

flow	pid	process
2	1108	rundll32.exe

pid	process
1108	rundll32.exe
1108	rundll32.exe

description	pid	process	target process
PID 1728 wrote to memory of 1108	1728	cmd.exe	rundll32.exe
PID 1728 wrote to memory of 1108	1728	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

memory/1108-119-0x0000000000000000-mapping.dmp

Download
memory/1108-120-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download