Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
04-11-2021 16:55
Static task
static1
Behavioral task
behavioral1
Sample
core.bat
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
core.bat
Resource
win10-en-20210920
Behavioral task
behavioral3
Sample
juice_64.tmp.dll
Resource
win7-en-20210920
Behavioral task
behavioral4
Sample
juice_64.tmp.dll
Resource
win10-en-20211014
General
-
Target
core.bat
-
Size
184B
-
MD5
00d922001e1ea040454c350b63619bd3
-
SHA1
b45abf4e6fe04d5e15514138ec4e5e020af0980d
-
SHA256
3b06cc4363bbc2dc5ec736e73b7807ac1beedd5bb8d08076f74736df17655157
-
SHA512
0de1ec67e3dfb55e89b309c0225da6f4db986eaa1cb4c0fd3b30526e594e74132cef82813e0201425a6aa0a8ed69dce4ca8f1ff8555433d5b68fad71b263aa6f
Malware Config
Extracted
icedid
Extracted
icedid
1217670233
lakogrefop.rest
hangetilin.top
follytresh.co
novemberprosse.space
-
auth_var
13
-
url_path
/posts/
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 33 3068 rundll32.exe 34 3068 rundll32.exe -
Modifies registry class 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{8A8FF2D3-7745-1657-44DF-D3B765BAD8D1} rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{8A8FF2D3-7745-1657-44DF-D3B765BAD8D1}\ = 815ecfb094d227e5f55af74667e84636850ceb97b79893e5c7f9e7c433cbf119f460b1bddbf888465ca26d3b7d622e7620a912a7ad4cf21b4ecf42c8033953586fa4f7bf8a043219c2d4f173b4be06f2a4dbf9aee2c548d385152cbb61e67f2a6665964ec1fb60fb4274cdae51806aec2d19fbe43dad16043c99137f3fb11ee5cee364ac01b734fd14edf2e8f6e4f4e1f3e0ea6170c10b782e9e9d244955a650898cef6ca40cf13fe8d72b4dba1072234bc1037bf693a08f238a673f4fd6667039a4037ead01fe21fdd2a29c1272b5911237ea9680ef14d91c78299ee0c192355127c356a5b67eaf94a88e2c4c39558286a00fe4aa77374358d9c6443349a10b74b5dde7576bb10bda8119ebf66b3f52cc9264cb84067bf382a288b61618ad9ef6e76aa38df9c9d8a70dc51bfe7b25d48c10e670bb132d32c818a7683fcf9606a09198f567aa83bd412d6ac69f2dcb8998a2946c49be06e9b5e17220ca10996206324559db1933f65e7ab39d24ce96903dc9929a231251215056339094993c48d13a523e2e rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exepid process 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
cmd.exedescription pid process target process PID 3256 wrote to memory of 3068 3256 cmd.exe rundll32.exe PID 3256 wrote to memory of 3068 3256 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\juice_64.tmp,DllMain /i="license.dat"2⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\license.datMD5
b03af34cc11c8bd53afd958c839dd59f
SHA1d9c90d8f770be66850ea0734580867c16d64b404
SHA25671c9c15896b027fd830423f6226587bdad3f09681799bf3e69abb0479f18a853
SHA512c33204f04a99272a1619a4fe6e3ba5e128c437968f8f570c12ffbf20a71e2b617535a70bf51f9d4ddcccc7f44804a13a4528ece4470e4ee53273ad1806313911
-
memory/3068-115-0x0000000000000000-mapping.dmp
-
memory/3068-117-0x0000021A55E40000-0x0000021A55E98000-memory.dmpFilesize
352KB
-
memory/3068-118-0x0000021A541E0000-0x0000021A54217000-memory.dmpFilesize
220KB