icedid | be443555adde2329d2e6392b6549c3856fa0ab250f3e56798e91044c1cd95751

Analysis

max time kernel
160s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 11:23

Target

a/seagem.bat
Size

1KB
MD5

54f37ed83c9c52fc14cfb808b56f558e
SHA1

576ac72dadf9e5b2b3d742bcf1ccda7002d76b87
SHA256

1195439fcd3deeff79ee8e3bc4d50e5c8015082e307182da2b252cc0ebf4f8e5
SHA512

7834ee399f4a0555606bee8ea54629c44a973f01d495572221e2b6003de8103ca83c177daf5003160162274f8dfa7232b946a16ac944e344f3d7b7bd589ffefe

Score

10^/10

Family

icedid

Campaign

2254758066

opraadeadiwenna.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

6 3812 rundll32.exe
37 3812 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3812 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

3812 rundll32.exe
3812 rundll32.exe
3812 rundll32.exe
3812 rundll32.exe
3812 rundll32.exe
3812 rundll32.exe

flow	pid	process
6	3812	rundll32.exe
37	3812	rundll32.exe

pid	process
3812	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2220 wrote to memory of 4016	2220	cmd.exe	xcopy.exe
PID 2220 wrote to memory of 4016	2220	cmd.exe	xcopy.exe
PID 2220 wrote to memory of 3812	2220	cmd.exe	rundll32.exe
PID 2220 wrote to memory of 3812	2220	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a\seagem.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220

C:\Windows\system32\xcopy.exe
xcopy /s /i /e /h unedifying.dll C:\Users\Admin\AppData\Local\Temp\*
2⤵
PID:4016

C:\Users\Admin\AppData\Local\Temp\unedifying.dll
Filesize
269KB

MD5
012da0b3ac0042942cd3b37915e799ba

SHA1
848ec6dadfd86129908bf5cf51e34fb1d0e3ca62

SHA256
c7d63b44ed478fe48468ddee84beb324712b22602b8c8a1ee2de75445f18528e

SHA512
bc5f4f3940035a71d810692c65dbec81c3344f6a454c4b6cf666286edbeda737fdfdb962e7009d32a37a02476424c98605b7a054b312ca9f0b47168e8bc0948c

Download Submit
C:\Users\Admin\AppData\Local\Temp\unedifying.dll
Filesize
269KB

MD5
012da0b3ac0042942cd3b37915e799ba

SHA1
848ec6dadfd86129908bf5cf51e34fb1d0e3ca62

SHA256
c7d63b44ed478fe48468ddee84beb324712b22602b8c8a1ee2de75445f18528e

SHA512
bc5f4f3940035a71d810692c65dbec81c3344f6a454c4b6cf666286edbeda737fdfdb962e7009d32a37a02476424c98605b7a054b312ca9f0b47168e8bc0948c

Download Submit
memory/3812-133-0x0000000000000000-mapping.dmp

Download
memory/3812-136-0x000002A34E210000-0x000002A34E219000-memory.dmp

Filesize
36KB

Download
memory/4016-132-0x0000000000000000-mapping.dmp

Download