icedid | 6751d66b22cf8065ffeb791490f89588abfbdb54d1cb005ba33000d9b8158d0c

Analysis

Target

loader.bat
Size

44B
MD5

c3b9d4db526699b5712cd68f381f7fc1
SHA1

186c032f01b361e6d0faa509e21b2bd8576e4bcb
SHA256

e8ad79db4480f652904f07566371acda37ba68e0f41c3a725d61b6dd57648f22
SHA512

070e6c818d943d360f098d82fb6e5c342713a62700a4fd11147ca4f2fa65b5dfde0cae72e87e3f1a8ba9c2c84ae57d0075624f51a42435af88c4a18115baee2b

Score

10^/10

Family

icedid

Campaign

3568430872

alionavon.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1984 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1984 rundll32.exe
1984 rundll32.exe

flow	pid	process
2	1984	rundll32.exe

pid	process
1984	rundll32.exe
1984	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1056 wrote to memory of 1984	1056	cmd.exe	rundll32.exe
PID 1056 wrote to memory of 1984	1056	cmd.exe	rundll32.exe
PID 1056 wrote to memory of 1984	1056	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\loader.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1056

memory/1984-54-0x0000000000000000-mapping.dmp

Download
memory/1984-55-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download