icedid | 887b4d1431f6193b1cd7fd5c15c4687ebcf2cbe7b2cecbbcf41260e401ebeeea

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

core.bat
Size

184B
MD5

d89cd3f80a0c0c1d6ef962509e593e88
SHA1

cd9835745e5c2170255c6e28f80b27482d37155b
SHA256

6799f0bb30fec071f472a8c71d85ac59c39e3f6d9e9901628fef5b8698f49fe1
SHA512

0dba4611d2750ceed996555cec347098853d51154335a45d3a828ff5ba50e34698fdfc2f8f48c22a8da4cd7077ae0a97b6b88ebbe55e4a814cfd036519cd9eaf

Score

10^/10

icedid 3415411565 banker core_loader trojan

Malware Config

Extracted

Family

icedid

Botnet

3415411565

antnosience.com

seaskysafe.com

otectagain.top

dilimoretast.com

Attributes

auth_var
17
url_path
/news/

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 4832	3464	cmd.exe	84
PID 3464 wrote to memory of 4832	3464	cmd.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\rely_x32.dat,DllMain /i="license.dat"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\license.dat

Filesize
336KB

MD5
e9ad8fae2dd8f9d12e709af20d9aefad

SHA1
db7d1545c3c7e60235700af672c1d20175b380cd

SHA256
84f016ece77ddd7d611ffc0cbb2ce24184aeee3a2fdbb9d44d0837bc533ba238

SHA512
4f652b4d2db81bd91e8a9cd8ca330748f7c98b21150ca2b640da2aad357adadeac80070177f9f253c595d683264d23e1f04701c2975c0e03caffd367d424d17f

Download Submit
memory/4832-6-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download
memory/4832-2-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download
memory/4832-8-0x0000026767190000-0x00000267671EA000-memory.dmp

Filesize
360KB

Download
memory/4832-14-0x0000026767190000-0x00000267671EA000-memory.dmp

Filesize
360KB

Download
memory/4832-15-0x0000026767190000-0x00000267671EA000-memory.dmp

Filesize
360KB

Download