Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

core.bat

windows7-x64

10

core.bat

windows10-2004-x64

10

pigeon64.dll

windows7-x64

10

pigeon64.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2024, 00:45 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    core.bat

  • Size

    184B

  • MD5

    2b4f27b826aec08eb90ff784b25d048d

  • SHA1

    b1444548b53ec112797cc7d03a1e227fe71315ca

  • SHA256

    b976471778c3abead8001c5a7db7d39b461e88bbd5322a579d86c1ca725375fb

  • SHA512

    d6316825b5372e445941b75b08b04aaee49bab12d752dba4691aac8093100d1632a1b07e6b7d6899c528e6777f0bcfcd977e02a7f8d559b29e205703f573d434

Score
10/10
icedid1217670233bankercore_loadercore_payloadtrojan

Malware Config

Extracted

Family

icedid

Botnet

1217670233

C2

nnelforwfin.top

lakogrefop.rest

hangetilin.top

follytresh.co
Attributes
  • auth_var

    12

  • url_path

    /posts/

Extracted

Family

icedid

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MGAwDQYJKoZIhvcNAQEBBQADTwAwTAJAAKQAAFJTQTEABAAAAQABAKlSRc15jKHF
3
IN/XH16Xs7H0+zt5y/M2AKBq1cXeePyLmhkS7duB17D/U9wqfzUSSwIIUHk7y9SY
4
9J8=
5
-----END PUBLIC KEY-----

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • Icedid family
    icedid
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3252
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\pigeon64.dat,DllMain /i="license.dat"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3324

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    68.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    68.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    21.49.80.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    21.49.80.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.163.245.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.163.245.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    follytresh.co
    rundll32.exe
    Remote address:
    8.8.8.8:53
    Request
    follytresh.co
    IN A
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    nnelforwfin.top
    rundll32.exe
    Remote address:
    8.8.8.8:53
    Request
    nnelforwfin.top
    IN A
    Response
  • flag-us
    DNS
    lakogrefop.rest
    rundll32.exe
    Remote address:
    8.8.8.8:53
    Request
    lakogrefop.rest
    IN A
    Response
  • flag-us
    DNS
    hangetilin.top
    rundll32.exe
    Remote address:
    8.8.8.8:53
    Request
    hangetilin.top
    IN A
    Response
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    68.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    68.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    21.49.80.91.in-addr.arpa
    dns
    70 B
     145 B
     1
    1

    DNS Request

    21.49.80.91.in-addr.arpa

  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    56.163.245.4.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    56.163.245.4.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    follytresh.co
    dns
    rundll32.exe
    59 B
     124 B
     1
    1

    DNS Request

    follytresh.co

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    nnelforwfin.top
    dns
    rundll32.exe
    61 B
     131 B
     1
    1

    DNS Request

    nnelforwfin.top

  • 8.8.8.8:53
    lakogrefop.rest
    dns
    rundll32.exe
    61 B
     126 B
     1
    1

    DNS Request

    lakogrefop.rest

  • 8.8.8.8:53
    hangetilin.top
    dns
    rundll32.exe
    60 B
     130 B
     1
    1

    DNS Request

    hangetilin.top

  • 8.8.8.8:53
    48.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    48.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\license.dat
    Filesize

    333KB

    MD5

    b03af34cc11c8bd53afd958c839dd59f

    SHA1

    d9c90d8f770be66850ea0734580867c16d64b404

    SHA256

    71c9c15896b027fd830423f6226587bdad3f09681799bf3e69abb0479f18a853

    SHA512

    c33204f04a99272a1619a4fe6e3ba5e128c437968f8f570c12ffbf20a71e2b617535a70bf51f9d4ddcccc7f44804a13a4528ece4470e4ee53273ad1806313911

    Download Submit

  • memory/3324-2-0x000001A275300000-0x000001A275337000-memory.dmp

    Filesize

    220KB

    Download

  • memory/3324-5-0x000001A2753A0000-0x000001A2753F8000-memory.dmp

    Filesize

    352KB

    Download

  • memory/3324-11-0x000001A2753A0000-0x000001A2753F8000-memory.dmp

    Filesize

    352KB

    Download

  • memory/3324-12-0x000001A2753A0000-0x000001A2753F8000-memory.dmp

    Filesize

    352KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.