Analysis
-
max time kernel
14s -
max time network
123s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
03-06-2021 13:43
Static task
static1
Behavioral task
behavioral1
Sample
a2a9ecf82d0ab335d901f5d7e4f085c4d03692e5eadb52d0ac5843d387204fe0.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
a2a9ecf82d0ab335d901f5d7e4f085c4d03692e5eadb52d0ac5843d387204fe0.dll
-
Size
429KB
-
MD5
cd88c540b4c5aa55947cf474e8e433af
-
SHA1
47bb790cecf426f51bb6111a8370f086ce9d94da
-
SHA256
a2a9ecf82d0ab335d901f5d7e4f085c4d03692e5eadb52d0ac5843d387204fe0
-
SHA512
4b82835e2ab7f2661e0509c9c99eb2cd2cf9bc7af7c4620e32e5e117d78cd91a56ef4e5a1cac1f7f80caa937cfb0596c8108ba1a9c92ca82356aec5f2811c287
Malware Config
Extracted
Family
icedid
Campaign
548569227
C2
buzzinmaster.live
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 852 created 1808 852 WerFault.exe regsvr32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 852 1808 WerFault.exe regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 852 WerFault.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a2a9ecf82d0ab335d901f5d7e4f085c4d03692e5eadb52d0ac5843d387204fe0.dll1⤵PID:1808
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1808 -s 4962⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:852
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1808-114-0x0000000000AA0000-0x0000000000AA7000-memory.dmpFilesize
28KB