icedid | 5712de8ced9e5624c0ecd193c678727fafeaa53debdbf2fa79b12a515d900c10 | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11-04-2023 13:47

Sharing

Report Analysis Logs

General

Target

run.bat
Size

52B
MD5

f48c6ca166cd1c784456253696146bea
SHA1

82bc0c4435b0ff1d7dbd271b67713db81a529ec1
SHA256

7c4167678967ec80002a8a841f79e652c1302f18061cf360814a2f573811061d
SHA512

d11abf6e813989b4b1b6815b207b91082950090297a380efe2d9d3c20433f256719850dad72007a1788dcb333b3dd0f8828cd0cce2c0d0cea5fb65b2cf2129e5

Score

10^/10

icedid 998075300 banker core_loader trojan

Malware Config

Extracted

Family

icedid

Botnet

998075300

C2

alishaskainz.com

villageskaier.com

Attributes

auth_var
55
url_path
/news/

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1768 wrote to memory of 1624	1768	cmd.exe	rundll32.exe
PID 1768 wrote to memory of 1624	1768	cmd.exe	rundll32.exe
PID 1768 wrote to memory of 1624	1768	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\system32\rundll32.exe
rundll32.exe guitar-.tmp,init --olquwo="license.dat"
2⤵
PID:1624

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-54-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download
memory/1624-58-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download
memory/1624-59-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download
memory/1624-60-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download