Resubmissions
07-03-2022 21:46
220307-1my3aagbh2 1028-02-2022 09:51
220228-lvldtsdhg4 1024-02-2022 19:51
220224-yk4hwaehap 1Analysis
-
max time kernel
1200s -
max time network
1077s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-02-2022 09:51
Static task
static1
Behavioral task
behavioral1
Sample
core.bat
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
core.bat
Resource
win10-20220223-en
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
strike64.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
strike64.dll
Resource
win10-20220223-en
windows10_x64
0 signatures
0 seconds
General
-
Target
core.bat
Score
10/10
Malware Config
Extracted
Family
icedid
rsa_pubkey.plain
Extracted
Family
icedid
Botnet
3560182600
C2
coolbearblunts.com
cooldogblunts.com
Attributes
-
auth_var
2
-
url_path
/news/
Signatures
-
Blocklisted process makes network request 9 IoCs
flow pid Process 3 944 rundll32.exe 5 944 rundll32.exe 7 944 rundll32.exe 8 944 rundll32.exe 10 944 rundll32.exe 11 944 rundll32.exe 12 944 rundll32.exe 13 944 rundll32.exe 15 944 rundll32.exe -
Loads dropped DLL 4 IoCs
pid Process 736 rundll32.exe 736 rundll32.exe 736 rundll32.exe 736 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1752 wrote to memory of 944 1752 cmd.exe 28 PID 1752 wrote to memory of 944 1752 cmd.exe 28 PID 1752 wrote to memory of 944 1752 cmd.exe 28 PID 1680 wrote to memory of 736 1680 taskeng.exe 32 PID 1680 wrote to memory of 736 1680 taskeng.exe 32 PID 1680 wrote to memory of 736 1680 taskeng.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\core.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\strike64.tmp,DllMain /i="license.dat"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:944
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {101F68E3-238C-4B35-A158-78175ACB2616} S-1-5-21-2329389628-4064185017-3901522362-1000:QSKGHMYQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Admin\Juinatct.dll",DllMain --er="license.dat"2⤵
- Loads dropped DLL
PID:736
-