Overview

overview

10

Static

static

3

core/cmd.bat

windows7-x64

10

core/cmd.bat

windows10-2004-x64

10

core/lava_.dll

windows7-x64

10

core/lava_.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-12-2024 21:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    core/cmd.bat

  • Size

    185B

  • MD5

    bac18ce4d5c2794b21ba4edbeb29b133

  • SHA1

    f783b8dcb137890099d2fae754aa0685c3df027d

  • SHA256

    251bc2dcfb073f229c16292b797dc08f89aa6aa91e32b44f5adb7466971e339a

  • SHA512

    9b26df943e2781ee520e0f173c5f6a3dcff5c9a06200965ed16a51c666f79330a1b30282f73ce81d9ee5cb95465f986ada272207aec3b88cb6dbb99ed27ae8b3

Score
10/10
icedid1525646893bankercore_loadercore_payloadtrojan

Malware Config

Extracted

Family

icedid

Botnet

1525646893

C2

survoning.top

engivesci.top

kastfiron.top

oscanonamik.buzz
Attributes
  • auth_var

    14

  • url_path

    /news/

Extracted

Family

icedid

rsa_pubkey.plain

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • Icedid family
    icedid
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\core\cmd.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1860
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\lava_.dat,update /i:"license.dat"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2880

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\license.dat
    Filesize

    333KB

    MD5

    3c6263a9c4117c78d26fc4380af014f2

    SHA1

    eca410dd57af16227220e08067c1895c258eb92b

    SHA256

    29d2a8344bd725d7a8b43cc77a82b3db57a5226ce792ac4b37e7f73ec468510e

    SHA512

    0969cde0d327b9f4b2be708437aea2a1d7a9ba9482125e143ce25c6a2f07e8ee1fa9b23e12f4e88157305f59209e2a8b3a2b2e7eb143b114e3f0c95ba57a2e1a

    Download Submit

  • memory/2880-2-0x00000000001A0000-0x00000000001D7000-memory.dmp

    Filesize

    220KB

    Download

  • memory/2880-4-0x0000000000410000-0x0000000000468000-memory.dmp

    Filesize

    352KB

    Download

  • memory/2880-11-0x0000000000410000-0x0000000000468000-memory.dmp

    Filesize

    352KB

    Download

  • memory/2880-10-0x0000000000410000-0x0000000000468000-memory.dmp

    Filesize

    352KB

    Download