icedid | 6751d66b22cf8065ffeb791490f89588abfbdb54d1cb005ba33000d9b8158d0c

Analysis

Target

loader.bat
Size

44B
MD5

c3b9d4db526699b5712cd68f381f7fc1
SHA1

186c032f01b361e6d0faa509e21b2bd8576e4bcb
SHA256

e8ad79db4480f652904f07566371acda37ba68e0f41c3a725d61b6dd57648f22
SHA512

070e6c818d943d360f098d82fb6e5c342713a62700a4fd11147ca4f2fa65b5dfde0cae72e87e3f1a8ba9c2c84ae57d0075624f51a42435af88c4a18115baee2b

Score

10^/10

Family

icedid

Campaign

3568430872

alionavon.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

12 2540 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2540 rundll32.exe
2540 rundll32.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 4256 wrote to memory of 2540 4256 cmd.exe rundll32.exe
PID 4256 wrote to memory of 2540 4256 cmd.exe rundll32.exe

flow	pid	process
12	2540	rundll32.exe

pid	process
2540	rundll32.exe
2540	rundll32.exe

description	pid	process	target process
PID 4256 wrote to memory of 2540	4256	cmd.exe	rundll32.exe
PID 4256 wrote to memory of 2540	4256	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\loader.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4256

memory/2540-130-0x0000000000000000-mapping.dmp

Download
memory/2540-131-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download