Analysis
-
max time kernel
90s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
29-06-2022 22:55
Static task
static1
Behavioral task
behavioral1
Sample
33667344.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
33667344.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
INV87162.txt.lnk
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
INV87162.txt.lnk
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
UFbjRkMGfw.ps1
Resource
win7-20220414-en
General
-
Target
INV87162.txt.lnk
-
Size
1KB
-
MD5
eee800539317857be2814e2961f5786b
-
SHA1
3b4031af710ea8116b7ae0c405182055b263441c
-
SHA256
9ba435872f1ef090c6eb506fcd7c07d903b8c7a26e772e8b1046f312258f5a04
-
SHA512
c5610f208d67274d59a391ce80f3358b3bb3c83297f34029a89c2e34f687940d1cd064abf0b41dc264fec8fbc36e61c08329896d42bdae9a765048ae2edd3cbd
Malware Config
Extracted
icedid
1842176049
carismortht.com
Signatures
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 13 4812 rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings powershell.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 4540 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exerundll32.exepid process 3880 powershell.exe 3880 powershell.exe 4812 rundll32.exe 4812 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3880 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exepowershell.exedescription pid process target process PID 3396 wrote to memory of 3880 3396 cmd.exe powershell.exe PID 3396 wrote to memory of 3880 3396 cmd.exe powershell.exe PID 3880 wrote to memory of 4540 3880 powershell.exe NOTEPAD.EXE PID 3880 wrote to memory of 4540 3880 powershell.exe NOTEPAD.EXE PID 3880 wrote to memory of 4812 3880 powershell.exe rundll32.exe PID 3880 wrote to memory of 4812 3880 powershell.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\INV87162.txt.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -w h -file UFbjRkMGfw.ps12⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\notice.txt3⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" 33667344.dll,#13⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3880-130-0x0000000000000000-mapping.dmp
-
memory/3880-131-0x000001ACAF7B0000-0x000001ACAF7D2000-memory.dmpFilesize
136KB
-
memory/3880-134-0x00007FFAE0AF0000-0x00007FFAE15B1000-memory.dmpFilesize
10.8MB
-
memory/4540-132-0x0000000000000000-mapping.dmp
-
memory/4812-133-0x0000000000000000-mapping.dmp
-
memory/4812-135-0x0000000180000000-0x0000000180009000-memory.dmpFilesize
36KB