icedid | b4871e79db266613a46a4673509d24d8791b7021fc733a893b83ac28a749d46e

Analysis

max time kernel
51s
max time network
74s
platform
windows10_x64
resource
win10-20220414-en
resource tags

arch:x64arch:x86image:win10-20220414-enlocale:en-usos:windows10-1703-x64system
submitted
03-08-2022 06:24

Target

1.bat
Size

38B
MD5

1f434861ea0659593c3e437dcb19a0bc
SHA1

8966c8c187bee3473d0b88a9a3af4575886cc017
SHA256

0c95de224223005498384a3dd58fa34f6dfb27f3f28cf0c6f296262c33b66797
SHA512

248dcb34c6005f15238406a088708852ebb4b56e8b0eb1fdf8fde941cab67b3fbfe77cf5884319837f1b3f8a1279618abb694b304d45a8b8741dc50664544463

Score

10^/10

Family

icedid

Campaign

380031663

sortswiminboard.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

3 1856 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1856 rundll32.exe
1856 rundll32.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 3152 wrote to memory of 1856 3152 cmd.exe rundll32.exe
PID 3152 wrote to memory of 1856 3152 cmd.exe rundll32.exe

flow	pid	process
3	1856	rundll32.exe

pid	process
1856	rundll32.exe
1856	rundll32.exe

description	pid	process	target process
PID 3152 wrote to memory of 1856	3152	cmd.exe	rundll32.exe
PID 3152 wrote to memory of 1856	3152	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3152

memory/1856-118-0x0000000000000000-mapping.dmp

Download
memory/1856-119-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download