Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
25-02-2022 22:44
Static task
static1
Behavioral task
behavioral1
Sample
core.bat
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
core.bat
Resource
win10v2004-en-20220113
Behavioral task
behavioral3
Sample
ridex32.dll
Resource
win7-20220223-en
Behavioral task
behavioral4
Sample
ridex32.dll
Resource
win10v2004-en-20220112
General
-
Target
core.bat
-
Size
182B
-
MD5
1c494d1c28af9cac5e1c26f9b9f79ce6
-
SHA1
fa138fdb8e22df8c6c04fefbfcc53be7bb20d017
-
SHA256
ae1821dda2a90fe35076771f7ea8619c4be1f3a7f2ec743875b016ba1f29ca4e
-
SHA512
bedd23fc38ee62a807933a850454de53d6ea1ef96c4d9758d69cf7695a58cddce357066773f91ee363b6743804ac1a8c23986b9dc9ad92c75afac482f5cfa415
Malware Config
Extracted
icedid
Extracted
icedid
3560182600
coolbearblunts.com
cooldogblunts.com
-
auth_var
2
-
url_path
/news/
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 3 1740 rundll32.exe 5 1740 rundll32.exe 7 1740 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exepid process 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe 1740 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 836 wrote to memory of 1740 836 cmd.exe rundll32.exe PID 836 wrote to memory of 1740 836 cmd.exe rundll32.exe PID 836 wrote to memory of 1740 836 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\core.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ridex32.tmp,DllMain /i="license.dat"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\license.datMD5
7eb64145636d2e8343d9077f15c11022
SHA1c0b221ca05431092bc1c789a33d199124c8fec1c
SHA25696e657e1face63798a43e6210dba8d8c2f618d0be1230b95ab59d8bd23fc165a
SHA51253171e09d3d146fe02e481944e1c5481f1bb48eaf66259d1b8bbbbf7a83efc4a73fc28089c7e1eacf221620cdff6ea7f1049c17720181fde88b4bdc27c1ea9b6
-
memory/1740-55-0x0000000002140000-0x0000000002199000-memory.dmpFilesize
356KB
-
memory/1740-56-0x00000000001A0000-0x00000000001A5000-memory.dmpFilesize
20KB