Analysis
-
max time kernel
152s -
max time network
165s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
29-01-2022 14:12
Static task
static1
Behavioral task
behavioral1
Sample
core.bat
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
core.bat
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
unit-x64.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
unit-x64.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
core.bat
Malware Config
Extracted
Family
icedid
rsa_pubkey.plain
Extracted
Family
icedid
Botnet
3415411565
C2
antnosience.com
seaskysafe.com
Attributes
-
auth_var
1
-
url_path
/news/
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 21 1288 rundll32.exe 23 1288 rundll32.exe 24 1288 rundll32.exe 25 1288 rundll32.exe -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
pid Process 1288 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Discovers systems in the same network 1 TTPs 2 IoCs
pid Process 3244 net.exe 3964 net.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 980 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2560 systeminfo.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\CLSID\{3CDA2A5B-5680-148B-E898-8943AAE85371} rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\CLSID\{3CDA2A5B-5680-148B-E898-8943AAE85371}\ = 63d3697803beaa0f131fc50fdca3f23a7995b4ab6ed7bff70a94b2eb14025d0ebab719cc0e0c5df0675237147ad41512927fd12f8d022711de58816c56fdbef3c39a6c8bf380b16e649e040d135c600c125131ce39885924888d2d69fe5fe403715274c4e5ca5973d8572a5f21ad15b6e3f33cc781ae42c2250d43af5898ed3df366a983bdc16d8a76be086c2a54c18d26db85daad14efaae97da70f2d482dc01c7c28c356a5b662b8923dd09b06ee7ab7d3a0891a2f2ac3602393ef7f0f rundll32.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 352 WMIC.exe Token: SeSecurityPrivilege 352 WMIC.exe Token: SeTakeOwnershipPrivilege 352 WMIC.exe Token: SeLoadDriverPrivilege 352 WMIC.exe Token: SeSystemProfilePrivilege 352 WMIC.exe Token: SeSystemtimePrivilege 352 WMIC.exe Token: SeProfSingleProcessPrivilege 352 WMIC.exe Token: SeIncBasePriorityPrivilege 352 WMIC.exe Token: SeCreatePagefilePrivilege 352 WMIC.exe Token: SeBackupPrivilege 352 WMIC.exe Token: SeRestorePrivilege 352 WMIC.exe Token: SeShutdownPrivilege 352 WMIC.exe Token: SeDebugPrivilege 352 WMIC.exe Token: SeSystemEnvironmentPrivilege 352 WMIC.exe Token: SeRemoteShutdownPrivilege 352 WMIC.exe Token: SeUndockPrivilege 352 WMIC.exe Token: SeManageVolumePrivilege 352 WMIC.exe Token: 33 352 WMIC.exe Token: 34 352 WMIC.exe Token: 35 352 WMIC.exe Token: 36 352 WMIC.exe Token: SeIncreaseQuotaPrivilege 352 WMIC.exe Token: SeSecurityPrivilege 352 WMIC.exe Token: SeTakeOwnershipPrivilege 352 WMIC.exe Token: SeLoadDriverPrivilege 352 WMIC.exe Token: SeSystemProfilePrivilege 352 WMIC.exe Token: SeSystemtimePrivilege 352 WMIC.exe Token: SeProfSingleProcessPrivilege 352 WMIC.exe Token: SeIncBasePriorityPrivilege 352 WMIC.exe Token: SeCreatePagefilePrivilege 352 WMIC.exe Token: SeBackupPrivilege 352 WMIC.exe Token: SeRestorePrivilege 352 WMIC.exe Token: SeShutdownPrivilege 352 WMIC.exe Token: SeDebugPrivilege 352 WMIC.exe Token: SeSystemEnvironmentPrivilege 352 WMIC.exe Token: SeRemoteShutdownPrivilege 352 WMIC.exe Token: SeUndockPrivilege 352 WMIC.exe Token: SeManageVolumePrivilege 352 WMIC.exe Token: 33 352 WMIC.exe Token: 34 352 WMIC.exe Token: 35 352 WMIC.exe Token: 36 352 WMIC.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3988 wrote to memory of 1288 3988 cmd.exe 69 PID 3988 wrote to memory of 1288 3988 cmd.exe 69 PID 1288 wrote to memory of 3260 1288 rundll32.exe 72 PID 1288 wrote to memory of 3260 1288 rundll32.exe 72 PID 3260 wrote to memory of 1220 3260 cmd.exe 75 PID 3260 wrote to memory of 1220 3260 cmd.exe 75 PID 1288 wrote to memory of 352 1288 rundll32.exe 76 PID 1288 wrote to memory of 352 1288 rundll32.exe 76 PID 1288 wrote to memory of 980 1288 rundll32.exe 78 PID 1288 wrote to memory of 980 1288 rundll32.exe 78 PID 1288 wrote to memory of 2560 1288 rundll32.exe 80 PID 1288 wrote to memory of 2560 1288 rundll32.exe 80 PID 1288 wrote to memory of 996 1288 rundll32.exe 84 PID 1288 wrote to memory of 996 1288 rundll32.exe 84 PID 996 wrote to memory of 988 996 net.exe 86 PID 996 wrote to memory of 988 996 net.exe 86 PID 1288 wrote to memory of 1636 1288 rundll32.exe 87 PID 1288 wrote to memory of 1636 1288 rundll32.exe 87 PID 1288 wrote to memory of 1708 1288 rundll32.exe 89 PID 1288 wrote to memory of 1708 1288 rundll32.exe 89 PID 1288 wrote to memory of 3244 1288 rundll32.exe 91 PID 1288 wrote to memory of 3244 1288 rundll32.exe 91 PID 1288 wrote to memory of 3964 1288 rundll32.exe 93 PID 1288 wrote to memory of 3964 1288 rundll32.exe 93 PID 1288 wrote to memory of 3104 1288 rundll32.exe 95 PID 1288 wrote to memory of 3104 1288 rundll32.exe 95 PID 3104 wrote to memory of 2180 3104 net.exe 97 PID 3104 wrote to memory of 2180 3104 net.exe 97 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\unit-x64.dat,DllMain /i="license.dat"2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1288 -
C:\Windows\system32\cmd.execmd.exe /c chcp >&23⤵
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\system32\chcp.comchcp4⤵PID:1220
-
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:352
-
-
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:980
-
-
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:2560
-
-
C:\Windows\system32\net.exenet config workstation3⤵
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 config workstation4⤵PID:988
-
-
-
C:\Windows\system32\nltest.exenltest /domain_trusts3⤵PID:1636
-
-
C:\Windows\system32\nltest.exenltest /domain_trusts /all_trusts3⤵PID:1708
-
-
C:\Windows\system32\net.exenet view /all /domain3⤵
- Discovers systems in the same network
PID:3244
-
-
C:\Windows\system32\net.exenet view /all3⤵
- Discovers systems in the same network
PID:3964
-
-
C:\Windows\system32\net.exenet group "Domain Admins" /domain3⤵
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group "Domain Admins" /domain4⤵PID:2180
-
-
-