Analysis

  • max time kernel
    150s
  • max time network
    97s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    21-12-2024 21:17

General

  • Target

    core.bat

  • Size

    184B

  • MD5

    8e8c8dd91722dd16c50d410e921dfca2

  • SHA1

    62524925b4f9c124d244aa9c42109877f36ff3fe

  • SHA256

    4e46bcf388758863f9938fb095521c0bfb5c8f41942341f3a6aa0e0e48e7672d

  • SHA512

    90de5ed56e2fdaa1d69315a19e1d6242b0ff5f6e41347893f98d02bf3f78a31cc954f8a193ca94e93942178928ddc5dc303bbce9bd4fde869032ea32831c6a4e

Malware Config

Extracted

Family

icedid

Botnet

302245654

C2

imilarquestio.top

heywanted.top

minimike.quest

alsohavethis.top

Attributes
  • auth_var

    5

  • url_path

    /posts/

Extracted

Family

icedid

rsa_pubkey.plain

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Icedid family
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2524
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\candyx32.dat,DllMain /i="license.dat"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1272

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\license.dat

    Filesize

    333KB

    MD5

    c7c45636ca690acdab7fba1e9d126f8b

    SHA1

    61376304cd90786813a80680a92cef03fedb6484

    SHA256

    cfc202b44509f2f607d365858a8218dfdc6b26f8087efcc5e46f4fef9ab53705

    SHA512

    9e6c7df9f70017b9eeb5868a358bc9eaf50de65dad04640220f380ff72e80bc303f034cb62929abb0c35d951b751732a131ae828c4c01cd1826610423f784db8

  • memory/1272-3-0x0000000000190000-0x00000000001C7000-memory.dmp

    Filesize

    220KB

  • memory/1272-5-0x0000000001BE0000-0x0000000001C39000-memory.dmp

    Filesize

    356KB

  • memory/1272-11-0x0000000001BE0000-0x0000000001C39000-memory.dmp

    Filesize

    356KB

  • memory/1272-12-0x0000000001BE0000-0x0000000001C39000-memory.dmp

    Filesize

    356KB