Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
04-11-2021 00:30
Static task
static1
Behavioral task
behavioral1
Sample
core.bat
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
core.bat
Resource
win10-en-20210920
Behavioral task
behavioral3
Sample
pigeon64.dat.dll
Resource
win7-en-20210920
Behavioral task
behavioral4
Sample
pigeon64.dat.dll
Resource
win10-en-20211014
General
-
Target
core.bat
-
Size
184B
-
MD5
2b4f27b826aec08eb90ff784b25d048d
-
SHA1
b1444548b53ec112797cc7d03a1e227fe71315ca
-
SHA256
b976471778c3abead8001c5a7db7d39b461e88bbd5322a579d86c1ca725375fb
-
SHA512
d6316825b5372e445941b75b08b04aaee49bab12d752dba4691aac8093100d1632a1b07e6b7d6899c528e6777f0bcfcd977e02a7f8d559b29e205703f573d434
Malware Config
Extracted
icedid
Extracted
icedid
1217670233
nnelforwfin.top
lakogrefop.rest
hangetilin.top
follytresh.co
-
auth_var
12
-
url_path
/posts/
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
rundll32.exeflow pid process 3 1116 rundll32.exe 5 1116 rundll32.exe 7 1116 rundll32.exe 9 1116 rundll32.exe -
Modifies registry class 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\CLSID\{761B2CCE-6E0B-6761-3EDC-F6CB2440F592} rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\CLSID\{761B2CCE-6E0B-6761-3EDC-F6CB2440F592}\ = 896d46f2959c9351d87d6e983f89e0dbcb13c56a143672a833365dd463e93082935c599b71642c5f32d560b070ea8fd1ce6d0e166d17d88211ad5281af8b7e7c94bf4ef0e598482bd02becf36bb31930385f6f7350787cb874509cacfd218d7729b4d13a914638101caec18fb6b1ece3a2916110a462cde8a586495de15b14762ed39c38cbda5ba172bc89ac0843c8e770a08a310825d51ffe3621d21042dc430753d999bf0a727f088703e1f47f2a57c182a18a6f463bc58e65c98e067b2f9d600132c5197ba94b227453d70e78a806e82cfc8d348967bf8fb616986d3e465f5ed99a7396ce9abd1b64b00961b695e216e873a2d7b08b05fb6f7db0695edb187a2a8bc2e41df3643d5d52b09b304723555e045dc69966c90ec69b3f15ac9f77a00af375fd572f3753a5962bd58a197abedc3ece10d3c03c5552214c0bdb756cb213f86bea532dae12e5753151c7f86636df818fe18e27d663ff0ced76b30baf898c6f2c44dc99f3d6ee02de9300fc7aa694ac801eeced68694ccfe4b163b1007aa85d00d1f2 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exepid process 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe 1116 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 1060 wrote to memory of 1116 1060 cmd.exe rundll32.exe PID 1060 wrote to memory of 1116 1060 cmd.exe rundll32.exe PID 1060 wrote to memory of 1116 1060 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\core.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\pigeon64.dat,DllMain /i="license.dat"2⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1116
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\license.datMD5
b03af34cc11c8bd53afd958c839dd59f
SHA1d9c90d8f770be66850ea0734580867c16d64b404
SHA25671c9c15896b027fd830423f6226587bdad3f09681799bf3e69abb0479f18a853
SHA512c33204f04a99272a1619a4fe6e3ba5e128c437968f8f570c12ffbf20a71e2b617535a70bf51f9d4ddcccc7f44804a13a4528ece4470e4ee53273ad1806313911
-
memory/1116-54-0x0000000000000000-mapping.dmp
-
memory/1116-56-0x0000000001B70000-0x0000000001BC8000-memory.dmpFilesize
352KB
-
memory/1116-57-0x0000000000110000-0x0000000000147000-memory.dmpFilesize
220KB