Resubmissions
28-07-2021 10:21
210728-47rr4fbrl2 1020-05-2021 22:30
210520-jb29avnrae 1006-04-2021 09:24
210406-3zhhrb3h12 10Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
20-05-2021 22:30
Static task
static1
Behavioral task
behavioral1
Sample
ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0.dll
-
Size
63KB
-
MD5
fcb6cf720c45b554c5f689fa914ffd2c
-
SHA1
4d247be7e4c3ee51c026c49dc4b9f59479e8ca77
-
SHA256
ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0
-
SHA512
a27fb5b32662f0624be8b96aaab8e8b09933dee0c996009970d8f7348d5df2142eb23f9215c35c95640a767399dce4636122dc81e58b5cc15ff3ffa3a6a86514
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
2608516171
C2
234willkids.uno
Signatures
-
IcedID First Stage Loader 1 IoCs
resource yara_rule behavioral2/memory/424-114-0x0000000000EE0000-0x0000000000EE7000-memory.dmp IcedidFirstLoader -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 424 regsvr32.exe 424 regsvr32.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3000 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3000 taskmgr.exe Token: SeSystemProfilePrivilege 3000 taskmgr.exe Token: SeCreateGlobalPrivilege 3000 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe 3000 taskmgr.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0.dll1⤵
- Suspicious behavior: EnumeratesProcesses
PID:424
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3000