Overview

overview

10

Static

static

3

core/cmd.bat

windows7-x64

10

core/cmd.bat

windows10-2004-x64

10

core/rewardx64.dll

windows7-x64

10

core/rewardx64.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2024, 12:00 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    core/cmd.bat

  • Size

    192B

  • MD5

    ac0f914288f8731b7122b83f1c7ffb2a

  • SHA1

    bc3fd58cf4b1688f0eaf1937924e7ab9e41bc7ee

  • SHA256

    d297edf3654a1e495d7a681f085bbb481b701efd2f05dbb07e5e2822da256473

  • SHA512

    5ad6962ad11432e826652fe0df13f6db76b93be34f59bcf2064d901a9e5e4e63b792d0e2b7a067eea51d8d3034e03cdae60a3281622a2f33d45860981f67d5db

Score
10/10
icedid1892568649bankercore_loadercore_payloadtrojan

Malware Config

Extracted

Family

icedid

Botnet

1892568649

C2

baeswea.com

bersaww.com
Attributes
  • auth_var

    10

  • url_path

    /news/

Extracted

Family

icedid

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MGAwDQYJKoZIhvcNAQEBBQADTwAwTAJAAKQAAFJTQTEABAAAAQABAKlSRc15jKHF
3
IN/XH16Xs7H0+zt5y/M2AKBq1cXeePyLmhkS7duB17D/U9wqfzUSSwIIUHk7y9SY
4
9J8=
5
-----END PUBLIC KEY-----

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • Icedid family
    icedid
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core\cmd.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3944
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\core\rewardx64.dat,DllMain --ma="license.dat"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:216

Network

  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    140.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    140.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.163.245.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.163.245.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.130.81.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.130.81.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    baeswea.com
    rundll32.exe
    Remote address:
    8.8.8.8:53
    Request
    baeswea.com
    IN A
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    bersaww.com
    rundll32.exe
    Remote address:
    8.8.8.8:53
    Request
    bersaww.com
    IN A
    Response
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    140.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    140.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    56.163.245.4.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    56.163.245.4.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    133.130.81.91.in-addr.arpa
    dns
    72 B
     147 B
     1
    1

    DNS Request

    133.130.81.91.in-addr.arpa

  • 8.8.8.8:53
    baeswea.com
    dns
    rundll32.exe
    57 B
     130 B
     1
    1

    DNS Request

    baeswea.com

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    bersaww.com
    dns
    rundll32.exe
    57 B
     130 B
     1
    1

    DNS Request

    bersaww.com

  • 8.8.8.8:53
    48.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    48.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\license.dat
    Filesize

    333KB

    MD5

    c7c45636ca690acdab7fba1e9d126f8b

    SHA1

    61376304cd90786813a80680a92cef03fedb6484

    SHA256

    cfc202b44509f2f607d365858a8218dfdc6b26f8087efcc5e46f4fef9ab53705

    SHA512

    9e6c7df9f70017b9eeb5868a358bc9eaf50de65dad04640220f380ff72e80bc303f034cb62929abb0c35d951b751732a131ae828c4c01cd1826610423f784db8

    Download Submit

  • memory/216-2-0x000002443ED20000-0x000002443ED57000-memory.dmp

    Filesize

    220KB

    Download

  • memory/216-5-0x000002443EDC0000-0x000002443EE19000-memory.dmp

    Filesize

    356KB

    Download

  • memory/216-11-0x000002443EDC0000-0x000002443EE19000-memory.dmp

    Filesize

    356KB

    Download

  • memory/216-12-0x000002443EDC0000-0x000002443EE19000-memory.dmp

    Filesize

    356KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.