Resubmissions
07-03-2022 21:46
220307-1my3aagbh2 1028-02-2022 09:51
220228-lvldtsdhg4 1024-02-2022 19:51
220224-yk4hwaehap 1Analysis
-
max time kernel
893s -
max time network
1623s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
07-03-2022 21:46
Static task
static1
Behavioral task
behavioral1
Sample
core.bat
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
core.bat
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
strike64.dll
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
strike64.dll
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
core.bat
-
Size
184B
-
MD5
59aa96fcaa1a3b7331758f7a7ae1f343
-
SHA1
198ffe332e90207fdb7b97da04770b001c0c5cbf
-
SHA256
5be1931accf2a90e273312b779a873e847ad965e6e11c04e9b83603d4e6e7491
-
SHA512
c67253d6d602e150e85e121b2d8d9dedfa72c3ea1950d6a50a8e52a201f06ff9e701acee04b49e682158fb9860c77fd7ad117e20d9c4c8b03938e53e7d6e99c7
Score
10/10
Malware Config
Extracted
Family
icedid
rsa_pubkey.plain
Extracted
Family
icedid
Botnet
3560182600
C2
coolbearblunts.com
cooldogblunts.com
Attributes
-
auth_var
2
-
url_path
/news/
Signatures
-
Blocklisted process makes network request 15 IoCs
flow pid Process 3 1844 rundll32.exe 5 1844 rundll32.exe 7 1844 rundll32.exe 8 1844 rundll32.exe 10 1844 rundll32.exe 11 1844 rundll32.exe 12 1844 rundll32.exe 14 1844 rundll32.exe 15 1844 rundll32.exe 17 1844 rundll32.exe 19 1844 rundll32.exe 21 1844 rundll32.exe 22 1844 rundll32.exe 24 1844 rundll32.exe 25 1844 rundll32.exe -
Loads dropped DLL 4 IoCs
pid Process 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1052 wrote to memory of 1844 1052 cmd.exe 28 PID 1052 wrote to memory of 1844 1052 cmd.exe 28 PID 1052 wrote to memory of 1844 1052 cmd.exe 28 PID 1936 wrote to memory of 1544 1936 taskeng.exe 32 PID 1936 wrote to memory of 1544 1936 taskeng.exe 32 PID 1936 wrote to memory of 1544 1936 taskeng.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\core.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\strike64.tmp,DllMain /i="license.dat"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1844
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {4669FE5B-789F-44F5-88A4-3B67E2420D8A} S-1-5-21-1405931862-909307831-4085185274-1000:GZAATBZA\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\{26640C5F-652C-2F51-31DF-798094065A5F}\{F2E5F9E6-7FD4-D45C-0BCC-62CE685D5308}\Eriskm.dll",DllMain --kaifye="license.dat"2⤵
- Loads dropped DLL
PID:1544
-