icedid | be443555adde2329d2e6392b6549c3856fa0ab250f3e56798e91044c1cd95751

Analysis

max time kernel
160s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 11:23

Target
a/seagem.bat
Size 1KB
Sample221206-ng89vach59
SHA256 1195439fcd3deeff79ee8e3bc4d50e5c8015082e307182da2b252cc0ebf4f8e5
MD5 54f37ed83c9c52fc14cfb808b56f558e
SHA1 576ac72dadf9e5b2b3d742bcf1ccda7002d76b87
SHA512 7834ee399f4a0555606bee8ea54629c44a973f01d495572221e2b6003de8103ca83c177daf5003160162274f8dfa7232b946a16ac944e344f3d7b7bd589ffefe
MD5 SHA1 SHA512

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	3812	rundll32.exe
37	3812	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
3812	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 4016	2220	cmd.exe	80
PID 2220 wrote to memory of 4016	2220	cmd.exe	80
PID 2220 wrote to memory of 3812	2220	cmd.exe	82
PID 2220 wrote to memory of 3812	2220	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a\seagem.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\xcopy.exe
  xcopy /s /i /e /h unedifying.dll C:\Users\Admin\AppData\Local\Temp\*
  2⤵
  PID:4016
- C:\Windows\system32\rundll32.exe
  rundll32 C:\Users\Admin\AppData\Local\Temp\unedifying.dll,init
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3812

unedifying.dll

Path C:\Users\Admin\AppData\Local\Temp\unedifying.dll
Size 269KB
SHA256 c7d63b44ed478fe48468ddee84beb324712b22602b8c8a1ee2de75445f18528e
MD5 012da0b3ac0042942cd3b37915e799ba
SHA1 848ec6dadfd86129908bf5cf51e34fb1d0e3ca62
SHA512 bc5f4f3940035a71d810692c65dbec81c3344f6a454c4b6cf666286edbeda737fdfdb962e7009d32a37a02476424c98605b7a054b312ca9f0b47168e8bc0948c
SSDEEP 6144:mTHJ5BU2WigC+/NZy40onBV14xjN8IcOzECLZ:8DB0igC+/NHBV1SjaCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

unedifying.dll

Path C:\Users\Admin\AppData\Local\Temp\unedifying.dll
Size 269KB
SHA256 c7d63b44ed478fe48468ddee84beb324712b22602b8c8a1ee2de75445f18528e
MD5 012da0b3ac0042942cd3b37915e799ba
SHA1 848ec6dadfd86129908bf5cf51e34fb1d0e3ca62
SHA512 bc5f4f3940035a71d810692c65dbec81c3344f6a454c4b6cf666286edbeda737fdfdb962e7009d32a37a02476424c98605b7a054b312ca9f0b47168e8bc0948c
SSDEEP 6144:mTHJ5BU2WigC+/NZy40onBV14xjN8IcOzECLZ:8DB0igC+/NHBV1SjaCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3812-136-0x000002A34E210000-0x000002A34E219000-memory.dmp

Download