Analysis
-
max time kernel
78s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
24/07/2022, 08:16
Static task
static1
Behavioral task
behavioral1
Sample
da8b0dfc72b00e8dbd27f4452720c529.dll
Resource
win7-20220718-en
4 signatures
150 seconds
General
-
Target
da8b0dfc72b00e8dbd27f4452720c529.dll
-
Size
96KB
-
MD5
da8b0dfc72b00e8dbd27f4452720c529
-
SHA1
388f93417a9765053283a21f552ef8e8ef021fea
-
SHA256
bfd2544f6cb03ada9421496069c9c523e61ba2c905fdbb718c2c8f63ff3c5167
-
SHA512
557b651e0975c9b890d6010f58404b0c62e2775ea1c298ed62c500036fa2475fd4313a2f66ed4baa711cffd67750e25343b06469c30f9722cc1dc939c2336069
Malware Config
Extracted
Family
icedid
Campaign
2937671378
C2
cootembrast.com
Signatures
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 4608 rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{30C95B0E-2BD2-46F7-BEFE-FBAA6B9773BB}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{8A189419-E768-42A6-9C2A-A6D79F4D3F90}.catalogItem svchost.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4608 rundll32.exe 4608 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\da8b0dfc72b00e8dbd27f4452720c529.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4608
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:2752