Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
15-04-2022 16:24
Static task
static1
Behavioral task
behavioral1
Sample
Мобілізаційний список.xls
Resource
win7-20220414-en
General
-
Target
Мобілізаційний список.xls
-
Size
32KB
-
MD5
3aa6bf4ed8c485717d767013d43f7cdb
-
SHA1
83ea9a8627819a7ba2ecad058f22e7f697256bc0
-
SHA256
08d30d6646117cd96320447042fb3857b4f82d80a92f31ee91b16044b87929c0
-
SHA512
db51c36533565f35b535fa4696a8992c2b1fa15cf93fb129c3ec740a394b6bff3cf43355e172c017f8ed762d99a73f2d157a0fb797cd827a228db39195652a5b
Malware Config
Extracted
icedid
2493865931
ertimadifa.com
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3428 1400 rundll32.exe EXCEL.EXE -
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 25 3428 rundll32.exe -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3428 rundll32.exe -
Drops file in Windows directory 1 IoCs
Processes:
EXCEL.EXEdescription ioc process File created C:\Windows\Tasks\su.dll EXCEL.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1400 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3428 rundll32.exe 3428 rundll32.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
EXCEL.EXEpid process 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 1400 wrote to memory of 3428 1400 EXCEL.EXE rundll32.exe PID 1400 wrote to memory of 3428 1400 EXCEL.EXE rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Мобілізаційний список.xls"1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32 C:\Windows\Tasks\su.dll, PluginInit2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Tasks\su.dllFilesize
150KB
MD589a0e6601d22c145a7dd5f5dd65b1f04
SHA10f964caafc104b44d371a71809f01ceca7a39128
SHA25655df2954add86715fc3d728459d79a6d2b88d34d9f23fafe9c5a573bb773d9e9
SHA5128082a826e48261eafd7bc446e88d7246b75715236825f35eef97d2badbf39b6bf22ec03a6101c89e5ae33a461da264d8f6dabf7a37428e751aa73d4139ae340f
-
\Windows\Tasks\su.dllFilesize
150KB
MD589a0e6601d22c145a7dd5f5dd65b1f04
SHA10f964caafc104b44d371a71809f01ceca7a39128
SHA25655df2954add86715fc3d728459d79a6d2b88d34d9f23fafe9c5a573bb773d9e9
SHA5128082a826e48261eafd7bc446e88d7246b75715236825f35eef97d2badbf39b6bf22ec03a6101c89e5ae33a461da264d8f6dabf7a37428e751aa73d4139ae340f
-
memory/1400-114-0x00007FFEACFA0000-0x00007FFEACFB0000-memory.dmpFilesize
64KB
-
memory/1400-115-0x00007FFEACFA0000-0x00007FFEACFB0000-memory.dmpFilesize
64KB
-
memory/1400-116-0x00007FFEACFA0000-0x00007FFEACFB0000-memory.dmpFilesize
64KB
-
memory/1400-117-0x00007FFEACFA0000-0x00007FFEACFB0000-memory.dmpFilesize
64KB
-
memory/3428-259-0x0000000000000000-mapping.dmp
-
memory/3428-262-0x0000000180000000-0x0000000180009000-memory.dmpFilesize
36KB