icedid | dc8e64794ac5e4b9b4495a936a5a001c09b86dc4774d184491fec192918146c7 | Triage

Analysis

max time kernel
246s
max time network
249s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-12-2022 08:54

Sharing

Report Analysis Logs

General

Target

run.bat
Size

63B
MD5

fe6a5ce4b6aa95bd0b100c5e8c1b3c54
SHA1

165d1ed5ba9d39021de2f8c1684988b17ccb40a2
SHA256

0e83b96bef38138c9cb80ab11020dfa015791337b69953f363b9ba694a35d932
SHA512

024d66b787c51ee8a10082ac16d3c8995ed667c18e60537a84822980dd6856038a3312331229e50f81b5c90c64c8704111e6f0c800b271bb6775889602989116

Score

10^/10

icedid 3247066813 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3247066813

C2

whothitheka.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

2 1676 rundll32.exe
4 1676 rundll32.exe
5 1676 rundll32.exe
6 1676 rundll32.exe
7 1676 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1676 rundll32.exe
1676 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 780 wrote to memory of 1676	780	cmd.exe	rundll32.exe
PID 780 wrote to memory of 1676	780	cmd.exe	rundll32.exe
PID 780 wrote to memory of 1676	780	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\pachow.dll,init
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1676-54-0x0000000000000000-mapping.dmp

Download
memory/1676-55-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download