Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
20/07/2022, 13:56
Static task
static1
Behavioral task
behavioral1
Sample
b4ramo.dll
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
b4ramo.dll
Resource
win10v2004-20220718-en
Behavioral task
behavioral3
Sample
documents.lnk
Resource
win7-20220715-en
Behavioral task
behavioral4
Sample
documents.lnk
Resource
win10v2004-20220718-en
General
-
Target
documents.lnk
-
Size
1KB
-
MD5
2ac780fa4ac2cf6e12c32d542601b999
-
SHA1
8179e357dbfc6b38fee5514e77aef0511a85d9ed
-
SHA256
aa2ee0a0341d11e12466d161d7e08ee29731e615e3cec6cc6769f3ab808f2c2e
-
SHA512
0d03b3b89bcd84c28cca8afafc98a400c3fae720562372166d0389f159c22ce0b559d508f21587e5e8bd207292e4ed0064d801e116bf40c9f6b4fb3cf89a9ab9
Malware Config
Extracted
icedid
4182822218
explorblins.com
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 1912 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1912 rundll32.exe 1912 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1448 wrote to memory of 1376 1448 cmd.exe 28 PID 1448 wrote to memory of 1376 1448 cmd.exe 28 PID 1448 wrote to memory of 1376 1448 cmd.exe 28 PID 1376 wrote to memory of 1912 1376 cmd.exe 29 PID 1376 wrote to memory of 1912 1376 cmd.exe 29 PID 1376 wrote to memory of 1912 1376 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\documents.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start rundll32.exe b4ramo.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\system32\rundll32.exerundll32.exe b4ramo.dll,#13⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1912
-
-