Analysis
-
max time kernel
79s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2022, 09:31
Static task
static1
Behavioral task
behavioral1
Sample
4a74a8f4bffd40c6feb8d82a25661e33.dll
Resource
win7-20220718-en
4 signatures
150 seconds
General
-
Target
4a74a8f4bffd40c6feb8d82a25661e33.dll
-
Size
110KB
-
MD5
4a74a8f4bffd40c6feb8d82a25661e33
-
SHA1
798ebb9e2a181c0ff0dd5dc77bc37a8a657987c7
-
SHA256
e47b6fc641151498bb50a5a6b065fe8c8d6abaf7c501f298d8f087e0953163a4
-
SHA512
5be34aedb85371298d5b376a237cd1c9189db13bfc0d5d4e3f98d036b401cbe29931d3ec9e03468483b949a79685bdc85910f4f6d35b474fcdce1d14c885eb6d
Malware Config
Extracted
Family
icedid
Campaign
244156380
C2
garbagewellduno.com
Signatures
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 4620 rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{602E72F0-DB8C-43F2-837A-EA3F592C0E4A}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{1BDD9BE0-DA87-4D79-9211-0F09F228ADBA}.catalogItem svchost.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4620 rundll32.exe 4620 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4a74a8f4bffd40c6feb8d82a25661e33.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4620
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:920