Analysis
- max time kernel
1328s - max time network
1230s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
28/02/2022, 09:51
Static task
static1
Behavioral task
behavioral1
Sample
core.bat
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
core.bat
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
planet64.dll
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
planet64.dll
Resource
win10-20220223-en
windows10_x64
0 signatures
0 seconds
General
- Target core.bat
- Size 184B
- Sample220228-lvgewadhg2
- SHA256 bcc176e2ec1bddb1518bcacb07fef99fe1812e204e990424549f11862aaa757c
- MD5 4da584cc0a5ded0c902627093ab8721b
- SHA1 a6bb30b50718813a72cbd58ba148bc3c9a17c3f0
- SHA512 d611696d95dd76f1c3f7ab90c370ccb734f1912ff340d28c5a050d0fb072c7914c3bd15ea30f8f2873fdb17f0b93da92eaa7eecc3b245e23c972c700777be804
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
icedid
rsa_pubkey.plain
Extracted
Family
-
icedid
Botnet
-
3415411565
C2
-
antnosience.com
-
seaskysafe.com
Attributes
-
auth_var
1
-
url_path
/news/
Signatures
- Blocklisted process makes network request 6 IoCs
flow pid Process 18 2068 rundll32.exe 20 2068 rundll32.exe 23 2068 rundll32.exe 24 2068 rundll32.exe 28 2068 rundll32.exe 30 2068 rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1772 wrote to memory of 2068 1772 cmd.exe 70 PID 1772 wrote to memory of 2068 1772 cmd.exe 70
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\planet64.tmp,DllMain /i="license.dat"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2068
-