Analysis
- max time kernel
151s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
22/02/2022, 16:13
Static task
static1
Behavioral task
behavioral1
Sample
core.bat
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
core.bat
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
relief-x64.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
relief-x64.dll
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target core.bat
- Size 188B
- Sample220222-tpe9macaaq
- SHA256 933793ba688465b30736a07fc9505a49c0a0053d88dc96ad8d5aa3e29a8768de
- MD5 a1550b458ee5d98525dbdb544cb3a183
- SHA1 a0672371da258190c2b4bc6aade702ee8db4a23c
- SHA512 91422eafa8072bd02d3ea371cfd0bd6570151f9eb9506649c3fd38175652be63921e0c6f125dd66771e66125b014a2cff3bdac63f40a33ab284dff81ed0ab061
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
icedid
rsa_pubkey.plain
Extracted
Family
-
icedid
Botnet
-
3026272684
C2
-
hashingold.top
-
asperuguz.store
-
loppidoaster.site
-
ndmarkrepo.top
Attributes
-
auth_var
1
-
url_path
/posts/
Signatures
- Blocklisted process makes network request 5 IoCs
flow pid Process 54 4472 rundll32.exe 56 4472 rundll32.exe 60 4472 rundll32.exe 62 4472 rundll32.exe 77 4472 rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe 4472 rundll32.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2756 wrote to memory of 4472 2756 cmd.exe 83 PID 2756 wrote to memory of 4472 2756 cmd.exe 83
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\relief-x64.dat,DllMain /i="license.dat"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4472
-