Resubmissions
28-07-2021 10:21
210728-47rr4fbrl2 1020-05-2021 22:30
210520-jb29avnrae 1006-04-2021 09:24
210406-3zhhrb3h12 10Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
06-04-2021 09:24
Static task
static1
Behavioral task
behavioral1
Sample
ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0.dll
-
Size
63KB
-
MD5
fcb6cf720c45b554c5f689fa914ffd2c
-
SHA1
4d247be7e4c3ee51c026c49dc4b9f59479e8ca77
-
SHA256
ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0
-
SHA512
a27fb5b32662f0624be8b96aaab8e8b09933dee0c996009970d8f7348d5df2142eb23f9215c35c95640a767399dce4636122dc81e58b5cc15ff3ffa3a6a86514
Malware Config
Extracted
Family
icedid
Campaign
2608516171
C2
234willkids.uno
Extracted
Family
icedid
rsa_pubkey.plain
Extracted
Family
icedid
Botnet
478101429
C2
gabry4saver.website
usser234dopper.space
tasyateles.club
jrburnit.website
Attributes
-
url_path
/news/
Signatures
-
IcedID First Stage Loader 1 IoCs
resource yara_rule behavioral1/memory/1812-3-0x00000000001C0000-0x00000000001C7000-memory.dmp IcedidFirstLoader -
Blocklisted process makes network request 2 IoCs
flow pid Process 14 1676 rundll32.exe 15 1676 rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 1676 rundll32.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\CLSID\{CE82B672-D5FB-A135-5712-86D97B08FBB2} rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\CLSID\{CE82B672-D5FB-A135-5712-86D97B08FBB2}\ = 443613d441fe8d76ad981de9418802f1741358981ca7da8e4edef124e7a76f4a484dc73fa240a374cab7be0d33856a6a48342ef564cc91bdb8a5c01df77f6fe98cecfac9a96b56f75978ff2bef5e40eb0834c7ea84ba799db65771afc0ae0a448ba9470492752682f648b09012af2cd53465be1dccdd535f2b36ff39587ae64d45df1ef96aeb522c27cb8723d152849d244ed5fe7e7acb8d99e012e7f2f4375db68a813bcc914fa033b51c61b41ebc6b31ca870721ab97af882b51329f822fce92da42364a214b5425050b79ca97056aaec0fe4f662a57d80d7af603fc7b32588c78ba833d946fbf87b80e71361d07871861ab1465be02f8f0f974bd50f6e86877de893dcace7885742649d365659b417fbb82b49ab6801be5f728245455b6d1ad03c0131ba361e26d25cd90cce0d3a89715f5f6e8eeecbeeb77bf00e76fb7d2ad0340d33bd3f94e rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1812 regsvr32.exe 1812 regsvr32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe 1676 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1812 wrote to memory of 1676 1812 regsvr32.exe 29 PID 1812 wrote to memory of 1676 1812 regsvr32.exe 29 PID 1812 wrote to memory of 1676 1812 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\arrive_x64.tmp",update /i:"SickCash\license.dat"2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1676
-