Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-06-2022 16:32
Static task
static1
Behavioral task
behavioral1
Sample
mar7nal/documents.lnk
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
mar7nal/documents.lnk
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
mar7nal/mar7nal.dll
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
mar7nal/mar7nal.dll
Resource
win10v2004-20220414-en
General
-
Target
mar7nal/documents.lnk
-
Size
2KB
-
MD5
c47da7e1fb88cc6dbfaba6c3d2fd2ad2
-
SHA1
026b447f94dca2a3959311bb2459f874e780d6a3
-
SHA256
db435a3dd2d860a1dcafad8712f0a233ad0ae9cb7f9277d20aed04b39e27a829
-
SHA512
695abaaf67b305fdebfc68d892af5e9456334c3926f322d9de5e39ed3294e5498e9a764615f704fa96253862ddef4e415c230fc29fa0e073d9b8c16c6264aa28
Malware Config
Extracted
icedid
3416991016
bredofenction.com
Signatures
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 10 3512 rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3512 rundll32.exe 3512 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
cmd.exedescription pid process target process PID 1956 wrote to memory of 3512 1956 cmd.exe rundll32.exe PID 1956 wrote to memory of 3512 1956 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\mar7nal\documents.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" mar7nal.dll,RunObject2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses