icedid | 660effaf33e85bc19be61ab5cfa64fc187bc9902317c292770a5a18683b000ed

Analysis

max time kernel
94s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 00:28

Target

core.bat
Size

186B
MD5

c69400616b3e6ff4875c8322f7ef0ed1
SHA1

da112c52c72f50a64ff4aabcec17f5f3c16c5148
SHA256

d6e0649ba38b6acbd75fd06d34cbe332220c4b6d7d774afceaa2816a6bd8ba68
SHA512

2c61b0c6578eb8306da959ad329723902469a07418b2ea80a93f330f59ce757c0d660b7ae915d6d14735e6557b324668c6fd1af9cc0da866cc139fc35e5df0f9

Score

10^/10

Family

icedid

Botnet

1820688957

timerework.fun

pexxota.space

Attributes

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5116	rundll32.exe
3004	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 5116	2352	cmd.exe	84
PID 2352 wrote to memory of 5116	2352	cmd.exe	84
PID 2352 wrote to memory of 3004	2352	cmd.exe	86
PID 2352 wrote to memory of 3004	2352	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vessel-64.dat,DllMain /i="license.dat"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:5116
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vessel-64.dat,update /i="license.dat"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3004

memory/3004-5-0x00007FFC62220000-0x00007FFC626A6000-memory.dmp

Filesize
4.5MB

Download
memory/3004-6-0x00007FFC62220000-0x00007FFC626A6000-memory.dmp

Filesize
4.5MB

Download
memory/5116-2-0x00007FFC7FE10000-0x00007FFC7FE12000-memory.dmp

Filesize
8KB

Download
memory/5116-3-0x00007FFC62225000-0x00007FFC624A8000-memory.dmp

Filesize
2.5MB

Download