icedid | 86eb2c2dd22c6c84e77351b52ec841a0aa5d3ef49f176bc073464bd09ac05a3a | Triage

Analysis

max time kernel
91s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 05:09

Sharing

Report Analysis Logs

General

Target

core.bat
Size

186B
MD5

cb539d823a0cb6aaf97acca94e99a744
SHA1

35b2bca0ed8d2379ab12e3e493b37aa919d87f56
SHA256

c83d581e5dd4eaa0b5977de0b256eed18f2d41d51d94cd8bb63945659bfdb084
SHA512

a8155122e35a1bccaf9a62b4fb132961694d02db8a8f5608f5332e48355f2fdf4a43c0c97a39d25ce5a4a3e6aa95d7fb1b28396dd0d4dc1b2802d605b0f49d2e

Score

10^/10

icedid 3036889562 banker core_loader trojan

Malware Config

Extracted

Family

icedid

Botnet

3036889562

C2

stooryallice.com

yellowpyrrol.com

Attributes

auth_var
1
url_path
/news/

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4752	4592	cmd.exe	86
PID 4592 wrote to memory of 4752	4592	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\disagree_.dat,DllMain /i="license.dat"
  2⤵
  PID:4752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4752-3-0x000002455FA90000-0x000002455FA95000-memory.dmp

Filesize
20KB

Download