Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
08/03/2022, 18:45
Static task
static1
Behavioral task
behavioral1
Sample
core.bat
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
core.bat
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
pistol32.dll
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
General
- Target core.bat
- Size 184B
- Sample220308-xd7raaaeg4
- SHA256 61ad4c75614d2a61ffb2423125d87b56eab3bfe3046f4c41e7ce402b3e512ed2
- MD5 4766e3cd2f4eb06fd1563a3dd3a7704f
- SHA1 cdb45f46f51bce83cedf8bbd1b7be775d32bad60
- SHA512 4d4c8409cb662989c1ef490291b959928a2a5ac4e98cde4106ea6a0ea1eb8b055603edfa136bb4c0ceacb4bc651ab557eddfb9731a5776290d2e7669b7838a4c
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
icedid
Botnet
-
273095221
C2
-
loniferast.top
-
hoseonlin.top
-
fallhuma.top
-
nefitsonyo.xyz
Attributes
-
auth_var
1
-
url_path
/news/
Signatures
- Blocklisted process makes network request 5 IoCs
flow pid Process 36 1048 rundll32.exe 37 1048 rundll32.exe 42 1048 rundll32.exe 44 1048 rundll32.exe 46 1048 rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1048 1492 cmd.exe 81 PID 1492 wrote to memory of 1048 1492 cmd.exe 81
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\pistol32.tmp,DllMain /i="license.dat"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1048
-