Resubmissions
07-03-2022 21:46
220307-1my3aagbh2 1028-02-2022 09:51
220228-lvldtsdhg4 1024-02-2022 19:51
220224-yk4hwaehap 1Analysis
-
max time kernel
1199s -
max time network
1083s -
platform
windows10_x64 -
resource
win10-20220223-en -
submitted
28-02-2022 09:51
Static task
static1
Behavioral task
behavioral1
Sample
core.bat
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
core.bat
Resource
win10-20220223-en
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
strike64.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
strike64.dll
Resource
win10-20220223-en
windows10_x64
0 signatures
0 seconds
General
-
Target
core.bat
Score
10/10
Malware Config
Extracted
Family
icedid
rsa_pubkey.plain
Extracted
Family
icedid
Botnet
3560182600
C2
coolbearblunts.com
cooldogblunts.com
Attributes
-
auth_var
2
-
url_path
/news/
Signatures
-
Blocklisted process makes network request 6 IoCs
flow pid Process 11 4060 rundll32.exe 13 4060 rundll32.exe 14 4060 rundll32.exe 15 4060 rundll32.exe 16 4060 rundll32.exe 17 4060 rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 3292 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe 4060 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3948 wrote to memory of 4060 3948 cmd.exe 43 PID 3948 wrote to memory of 4060 3948 cmd.exe 43
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\strike64.tmp,DllMain /i="license.dat"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4060
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\{F046E788-CEBD-C891-47E6-95AD8954F6D9}\najeiw\Liehfads.dll",DllMain --somota="license.dat"1⤵
- Loads dropped DLL
PID:3292