icedid | 86eb2c2dd22c6c84e77351b52ec841a0aa5d3ef49f176bc073464bd09ac05a3a | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 05:09

Sharing

Report Analysis Logs

General

Target

core.bat
Size

186B
MD5

cb539d823a0cb6aaf97acca94e99a744
SHA1

35b2bca0ed8d2379ab12e3e493b37aa919d87f56
SHA256

c83d581e5dd4eaa0b5977de0b256eed18f2d41d51d94cd8bb63945659bfdb084
SHA512

a8155122e35a1bccaf9a62b4fb132961694d02db8a8f5608f5332e48355f2fdf4a43c0c97a39d25ce5a4a3e6aa95d7fb1b28396dd0d4dc1b2802d605b0f49d2e

Score

10^/10

icedid 3036889562 banker core_loader trojan

Malware Config

Extracted

Family

icedid

Botnet

3036889562

C2

stooryallice.com

yellowpyrrol.com

Attributes

auth_var
1
url_path
/news/

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 1628	2488	cmd.exe	32
PID 2488 wrote to memory of 1628	2488	cmd.exe	32
PID 2488 wrote to memory of 1628	2488	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\disagree_.dat,DllMain /i="license.dat"
  2⤵
  PID:1628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-2-0x0000000000110000-0x0000000000115000-memory.dmp

Filesize
20KB

Download