Analysis
-
max time kernel
115s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
14-04-2022 09:49
Static task
static1
Behavioral task
behavioral1
Sample
Мобілізаційний реєстр.xls
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
Мобілізаційний реєстр.xls
Resource
win10v2004-20220310-en
General
-
Target
Мобілізаційний реєстр.xls
-
Size
32KB
-
MD5
9f33887a8e76c246753e71b896a904b3
-
SHA1
19fa96a6d69146fceef3f3804cd978ec24adb3eb
-
SHA256
65b208943d8cf82af902c39400bdd7a26fdbc94c23f9d4494cf0a2ca51233213
-
SHA512
a3a37f55c185aafeb728335ab54c378adbc5e1a11a3079f3af7d16f4e5635d183017d6fa1eb22f706df2eabaf6fc3864259ef51422b3e392843d2825ebe358e0
Malware Config
Extracted
icedid
2352744503
rivertimad.com
Signatures
-
IcedID First Stage Loader 1 IoCs
Processes:
resource yara_rule behavioral2/memory/388-142-0x0000000140000000-0x000000014000B000-memory.dmp IcedidFirstLoader -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
runsx.exepid process 388 runsx.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2164 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
runsx.exepid process 388 runsx.exe 388 runsx.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 2164 EXCEL.EXE 2164 EXCEL.EXE 2164 EXCEL.EXE 2164 EXCEL.EXE 2164 EXCEL.EXE 2164 EXCEL.EXE 2164 EXCEL.EXE 2164 EXCEL.EXE 2164 EXCEL.EXE 2164 EXCEL.EXE 2164 EXCEL.EXE 2164 EXCEL.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 2164 wrote to memory of 388 2164 EXCEL.EXE runsx.exe PID 2164 wrote to memory of 388 2164 EXCEL.EXE runsx.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Мобілізаційний реєстр.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\runsx.exeC:\Users\Admin\AppData\Roaming\runsx.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\runsx.exeFilesize
2.1MB
MD5c52150ad226963a07cfc144d9cea73c7
SHA1235912e865829ae7b9196fc4a1df4dfe8123dcfb
SHA256ac1d19c5942946f9eee6bc748dee032b97eb3ec3e4bb64fead3e5ac101fb1bc8
SHA51243ae77c0e0c94e7b9525906dae115497c7dd49afabccd64d37b224e75931b09bff8dedf81a9cd3bf9454f75e4a67c4355f19dd8bcbe25b8b06eee32f2240a7cc
-
C:\Users\Admin\AppData\Roaming\runsx.exeFilesize
2.1MB
MD5c52150ad226963a07cfc144d9cea73c7
SHA1235912e865829ae7b9196fc4a1df4dfe8123dcfb
SHA256ac1d19c5942946f9eee6bc748dee032b97eb3ec3e4bb64fead3e5ac101fb1bc8
SHA51243ae77c0e0c94e7b9525906dae115497c7dd49afabccd64d37b224e75931b09bff8dedf81a9cd3bf9454f75e4a67c4355f19dd8bcbe25b8b06eee32f2240a7cc
-
memory/388-139-0x0000000000000000-mapping.dmp
-
memory/388-142-0x0000000140000000-0x000000014000B000-memory.dmpFilesize
44KB
-
memory/2164-137-0x00007FFBE4C90000-0x00007FFBE4CA0000-memory.dmpFilesize
64KB
-
memory/2164-138-0x00007FFBE4C90000-0x00007FFBE4CA0000-memory.dmpFilesize
64KB
-
memory/2164-134-0x00007FFBE4C90000-0x00007FFBE4CA0000-memory.dmpFilesize
64KB
-
memory/2164-135-0x00007FFBE4C90000-0x00007FFBE4CA0000-memory.dmpFilesize
64KB
-
memory/2164-136-0x00007FFBE4C90000-0x00007FFBE4CA0000-memory.dmpFilesize
64KB
-
memory/2164-143-0x00007FFBE4C90000-0x00007FFBE4CA0000-memory.dmpFilesize
64KB
-
memory/2164-144-0x00007FFBE4C90000-0x00007FFBE4CA0000-memory.dmpFilesize
64KB
-
memory/2164-145-0x00007FFBE4C90000-0x00007FFBE4CA0000-memory.dmpFilesize
64KB
-
memory/2164-146-0x00007FFBE4C90000-0x00007FFBE4CA0000-memory.dmpFilesize
64KB