Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
17/02/2022, 15:33
Static task
static1
Behavioral task
behavioral1
Sample
core.bat
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
core.bat
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
oak_32.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
oak_32.dll
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
core.bat
Malware Config
Extracted
Family
icedid
rsa_pubkey.plain
Extracted
Family
icedid
Botnet
3036889562
C2
stooryallice.com
yellowpyrrol.com
Attributes
-
auth_var
1
-
url_path
/news/
Signatures
-
Blocklisted process makes network request 5 IoCs
flow pid Process 3 1924 rundll32.exe 5 1924 rundll32.exe 6 1924 rundll32.exe 7 1924 rundll32.exe 9 1924 rundll32.exe -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
pid Process 1924 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Discovers systems in the same network 1 TTPs 2 IoCs
pid Process 1120 net.exe 1556 net.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 1964 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 556 systeminfo.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\CLSID\{518DC93A-8CFA-8249-1A5D-DF1DE56DB9E6} rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\CLSID\{518DC93A-8CFA-8249-1A5D-DF1DE56DB9E6}\ = be8b35c550ae3434c5d01c6fc9417e8fb30b84d8f7cc9b426a9f86246c74a0fb01e564e2f12cf23ce304b779561ec4b0525418d702430d08522a920fb12f60a82666508f7ac24d323d782f7c3211a68e8059a1032f472ffff373d14a926edbdf24a74e8c69b65875dddb47b2c094e4f725093a6cd2ec90dd9f0086a0a42e40d5e768a60df03c6817d3e0f17cac0a6f375e44c80fa77abe10ace862af0323573bc59f3e49d2af307b47c6fa733b4953af8db6095b0e37d18ed9a119f5f6a8155a54d6e1efe724fc51f1e968b514e96eb49eb748d48f996155c7622c9b63811a rundll32.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe 1924 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1652 WMIC.exe Token: SeSecurityPrivilege 1652 WMIC.exe Token: SeTakeOwnershipPrivilege 1652 WMIC.exe Token: SeLoadDriverPrivilege 1652 WMIC.exe Token: SeSystemProfilePrivilege 1652 WMIC.exe Token: SeSystemtimePrivilege 1652 WMIC.exe Token: SeProfSingleProcessPrivilege 1652 WMIC.exe Token: SeIncBasePriorityPrivilege 1652 WMIC.exe Token: SeCreatePagefilePrivilege 1652 WMIC.exe Token: SeBackupPrivilege 1652 WMIC.exe Token: SeRestorePrivilege 1652 WMIC.exe Token: SeShutdownPrivilege 1652 WMIC.exe Token: SeDebugPrivilege 1652 WMIC.exe Token: SeSystemEnvironmentPrivilege 1652 WMIC.exe Token: SeRemoteShutdownPrivilege 1652 WMIC.exe Token: SeUndockPrivilege 1652 WMIC.exe Token: SeManageVolumePrivilege 1652 WMIC.exe Token: 33 1652 WMIC.exe Token: 34 1652 WMIC.exe Token: 35 1652 WMIC.exe Token: SeIncreaseQuotaPrivilege 1652 WMIC.exe Token: SeSecurityPrivilege 1652 WMIC.exe Token: SeTakeOwnershipPrivilege 1652 WMIC.exe Token: SeLoadDriverPrivilege 1652 WMIC.exe Token: SeSystemProfilePrivilege 1652 WMIC.exe Token: SeSystemtimePrivilege 1652 WMIC.exe Token: SeProfSingleProcessPrivilege 1652 WMIC.exe Token: SeIncBasePriorityPrivilege 1652 WMIC.exe Token: SeCreatePagefilePrivilege 1652 WMIC.exe Token: SeBackupPrivilege 1652 WMIC.exe Token: SeRestorePrivilege 1652 WMIC.exe Token: SeShutdownPrivilege 1652 WMIC.exe Token: SeDebugPrivilege 1652 WMIC.exe Token: SeSystemEnvironmentPrivilege 1652 WMIC.exe Token: SeRemoteShutdownPrivilege 1652 WMIC.exe Token: SeUndockPrivilege 1652 WMIC.exe Token: SeManageVolumePrivilege 1652 WMIC.exe Token: 33 1652 WMIC.exe Token: 34 1652 WMIC.exe Token: 35 1652 WMIC.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1692 wrote to memory of 1924 1692 cmd.exe 28 PID 1692 wrote to memory of 1924 1692 cmd.exe 28 PID 1692 wrote to memory of 1924 1692 cmd.exe 28 PID 1924 wrote to memory of 1988 1924 rundll32.exe 31 PID 1924 wrote to memory of 1988 1924 rundll32.exe 31 PID 1924 wrote to memory of 1988 1924 rundll32.exe 31 PID 1988 wrote to memory of 1480 1988 cmd.exe 33 PID 1988 wrote to memory of 1480 1988 cmd.exe 33 PID 1988 wrote to memory of 1480 1988 cmd.exe 33 PID 1924 wrote to memory of 1652 1924 rundll32.exe 34 PID 1924 wrote to memory of 1652 1924 rundll32.exe 34 PID 1924 wrote to memory of 1652 1924 rundll32.exe 34 PID 1924 wrote to memory of 1964 1924 rundll32.exe 36 PID 1924 wrote to memory of 1964 1924 rundll32.exe 36 PID 1924 wrote to memory of 1964 1924 rundll32.exe 36 PID 1924 wrote to memory of 556 1924 rundll32.exe 38 PID 1924 wrote to memory of 556 1924 rundll32.exe 38 PID 1924 wrote to memory of 556 1924 rundll32.exe 38 PID 1924 wrote to memory of 1328 1924 rundll32.exe 42 PID 1924 wrote to memory of 1328 1924 rundll32.exe 42 PID 1924 wrote to memory of 1328 1924 rundll32.exe 42 PID 1328 wrote to memory of 1168 1328 net.exe 44 PID 1328 wrote to memory of 1168 1328 net.exe 44 PID 1328 wrote to memory of 1168 1328 net.exe 44 PID 1924 wrote to memory of 964 1924 rundll32.exe 45 PID 1924 wrote to memory of 964 1924 rundll32.exe 45 PID 1924 wrote to memory of 964 1924 rundll32.exe 45 PID 1924 wrote to memory of 560 1924 rundll32.exe 47 PID 1924 wrote to memory of 560 1924 rundll32.exe 47 PID 1924 wrote to memory of 560 1924 rundll32.exe 47 PID 1924 wrote to memory of 1120 1924 rundll32.exe 49 PID 1924 wrote to memory of 1120 1924 rundll32.exe 49 PID 1924 wrote to memory of 1120 1924 rundll32.exe 49 PID 1924 wrote to memory of 1556 1924 rundll32.exe 52 PID 1924 wrote to memory of 1556 1924 rundll32.exe 52 PID 1924 wrote to memory of 1556 1924 rundll32.exe 52 PID 1924 wrote to memory of 984 1924 rundll32.exe 54 PID 1924 wrote to memory of 984 1924 rundll32.exe 54 PID 1924 wrote to memory of 984 1924 rundll32.exe 54 PID 984 wrote to memory of 872 984 net.exe 56 PID 984 wrote to memory of 872 984 net.exe 56 PID 984 wrote to memory of 872 984 net.exe 56 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\core.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\oak_32.tmp,DllMain /i="license.dat"2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1924 -
C:\Windows\system32\cmd.execmd.exe /c chcp >&23⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\system32\chcp.comchcp4⤵PID:1480
-
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
-
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:1964
-
-
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:556
-
-
C:\Windows\system32\net.exenet config workstation3⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 config workstation4⤵PID:1168
-
-
-
C:\Windows\system32\nltest.exenltest /domain_trusts3⤵PID:964
-
-
C:\Windows\system32\nltest.exenltest /domain_trusts /all_trusts3⤵PID:560
-
-
C:\Windows\system32\net.exenet view /all /domain3⤵
- Discovers systems in the same network
PID:1120
-
-
C:\Windows\system32\net.exenet view /all3⤵
- Discovers systems in the same network
PID:1556
-
-
C:\Windows\system32\net.exenet group "Domain Admins" /domain3⤵
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group "Domain Admins" /domain4⤵PID:872
-
-
-