Analysis
- max time kernel
151s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
25/03/2022, 15:51
Static task
static1
Behavioral task
behavioral1
Sample
core/cmd.bat
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
core/cmd.bat
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
core/paper_x32.dll
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
core/paper_x32.dll
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target core/cmd.bat
- Size 191B
- Sample220325-tasamseefm
- SHA256 9eab93f08e471564ec1512005abb8e055119eefa66d12296487351e546aeb56c
- MD5 3cec7da4286fb8df01a057c04cc16b34
- SHA1 be35d3e4fd882a807495f1dec189d09324b79612
- SHA512 4d026d0dddf21aa105c9c0b45f791c5651c7dffb89701bf52fb71c7954648687f1be996d30c48ebe923794aeec31730f3dedb4df2e69b70c72f8dce0ed4d8d00
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
icedid
Botnet
-
3415411565
C2
-
antnosience.com
-
seaskysafe.com
-
otectagain.top
-
dilimoretast.com
Attributes
-
auth_var
18
-
url_path
/news/
Signatures
- Blocklisted process makes network request 5 IoCs
flow pid Process 28 784 rundll32.exe 29 784 rundll32.exe 31 784 rundll32.exe 33 784 rundll32.exe 35 784 rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe 784 rundll32.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3840 wrote to memory of 784 3840 cmd.exe 80 PID 3840 wrote to memory of 784 3840 cmd.exe 80
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core\cmd.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\core\paper_x32.dat,DllMain --ma="license.dat"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:784
-