icedid | 3ff23f059a6349fc8c4db8dbf312aea52438e5eb9c085b30889666fc6f65b0e1

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/12/2024, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

core.bat
Size

184B
MD5

cd3bdf58de37eece564f8fba168598d3
SHA1

244261d4d0087ad54085a336d268dd9e6e8bba04
SHA256

0aef9f9f7d660d03591f5514445992ace6b01c3986b6864309e0acb90dadc28a
SHA512

15900093569a86e2d6e46fdf63c3cc28a8dd597c8b32ea04a7e72c45d444dcef6a44c83828b957e1868f9d499939629ad8f3f4412e273fdd8d07b418b40a22bf

Score

10^/10

icedid 2354879232 banker core_loader core_payload trojan

Malware Config

Extracted

Family

icedid

Botnet

2354879232

gadverjo.com

hevciak.com

reseptors.com

smallbadcity.com

Attributes

auth_var
13
url_path
/news/

Extracted

Family

icedid

rsa_pubkey.plain

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 3040	1920	cmd.exe	31
PID 1920 wrote to memory of 3040	1920	cmd.exe	31
PID 1920 wrote to memory of 3040	1920	cmd.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fruit_32.tmp,DllMain /i="license.dat"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\license.dat

Filesize
333KB

MD5
c7c45636ca690acdab7fba1e9d126f8b

SHA1
61376304cd90786813a80680a92cef03fedb6484

SHA256
cfc202b44509f2f607d365858a8218dfdc6b26f8087efcc5e46f4fef9ab53705

SHA512
9e6c7df9f70017b9eeb5868a358bc9eaf50de65dad04640220f380ff72e80bc303f034cb62929abb0c35d951b751732a131ae828c4c01cd1826610423f784db8

Download Submit
memory/3040-2-0x000007FFFFFA0000-0x000007FFFFFA5000-memory.dmp

Filesize
20KB

Download
memory/3040-4-0x0000000001DC0000-0x0000000001E19000-memory.dmp

Filesize
356KB

Download
memory/3040-10-0x0000000001DC0000-0x0000000001E19000-memory.dmp

Filesize
356KB

Download
memory/3040-11-0x0000000001DC0000-0x0000000001E19000-memory.dmp

Filesize
356KB

Download