Analysis
- max time kernel
149s - max time network
125s - platform
windows10_x64 - resource
win10v20210408 - submitted
23/06/2021, 14:18
Static task
static1
Behavioral task
behavioral1
Sample
core/cmd.bat
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
core/cmd.bat
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
core/genre-64.dat.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
core/genre-64.dat.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target core/cmd.bat
- Size 188B
- Sample210623-fa6mx24cr2
- SHA256 68867aec1fd8a6eb416081c747705e847de95c033f5b38eb57ea575c69397210
- MD5 18922a31adfef9144b9c68694a211b48
- SHA1 1e63fbb6511e15ba07f555c11b2a05d63e49b5a3
- SHA512 573349edbae1baf769457402c65670b9d76facec7c056010a7b2a556d433d9176418cd4a2a39dd04654c3c4216019d27d47e15a6c1fd4f4fdcc57d5f98664a4a
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
icedid
rsa_pubkey.plain
Extracted
Family
-
icedid
Botnet
-
987543880
C2
-
fimlubindu.top
-
vindurualeg.top
-
bigcostarikas.top
-
extrimefigim.top
Attributes
-
auth_var
8
-
url_path
/news/
Signatures
- Blocklisted process makes network request 2 IoCs
flow pid Process 16 580 rundll32.exe 18 580 rundll32.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{9C56E359-4ED7-E889-A0D0-890212DFC268} rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{9C56E359-4ED7-E889-A0D0-890212DFC268}\ = 7326f71108cf34350e6f1030e0e51b5badd2aa61ce1308cc5b509ae01a6f5203e1883fbdf5c90b58c7938c18d1d15769e2f60490c53d230183f65c65ab8a4e451d5f4ac1b100d31a42624b573a2bc1345f1802f206046aa202c3147f4b89a8ed21e23fd56fda4f18e6d8fc1b54e8b6d572b5810fd683b704cba09ca02b4c4dc725cf16c59cf6552eae0ee4f774bd0168a9c6e31d6b318886ad8f338b9b95fcea672ec0d464154a3c51c0e5f0f26a23cc8c1821285ddd44e47c26cecc7b85f46629c39d71954ed78aab9da88b1073ea9298300bb89ab31598edfe264f56254c9e3970d51c63bb9f235edaf4aa3a2adc1ea474b40a70692a22405cdc187b629fc3bb8ca08a9632c97734d183aa91248be37f2c1dc38e3d4a0e58b50c42db1cf923fed2a4909624c5fbfeecffff7f7d4a4ca6d0aa03c0139b630132c519fbe92bf2dcad9a2fcc7939524536d04a5543d9082637d49ab8d5ccef9fb490067ce6dde29c27caf07533dd9d3bdfcf1663a91022b517fa68fdf0c98e83b414c5d56395879c225057b716ea623216d4fb6e7c504621cc4b3ba5843e4dd166659bc1bd93af01c292812fd787122128dd9d64d404c29c6337abfdebe06e20844c998ab40e732cca8d2ed1879da355762a5707c68d3f4b8f99143b4ad766ac4e2174d0046cb91efe6f334fca7d3ec7c03f5551fa91a111440f593423 rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe 580 rundll32.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3628 wrote to memory of 580 3628 cmd.exe 73 PID 3628 wrote to memory of 580 3628 cmd.exe 73
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core\cmd.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\core\genre-64.dat,update /i:"license.dat"2⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:580
-