Overview
overview
10Static
static
pack2.zip
windows10-1703-x64
1pack2.zip
windows10-2004-x64
11.bat
windows10-1703-x64
101.bat
windows10-2004-x64
10ScannedDoc...55.lnk
windows10-1703-x64
3ScannedDoc...55.lnk
windows10-2004-x64
7documents.lnk
windows10-1703-x64
10documents.lnk
windows10-2004-x64
10kon4an.dll
windows10-1703-x64
1kon4an.dll
windows10-2004-x64
1local.dll
windows10-1703-x64
10local.dll
windows10-2004-x64
10Analysis
-
max time kernel
51s -
max time network
73s -
platform
windows10_x64 -
resource
win10-20220414-en -
resource tags
arch:x64arch:x86image:win10-20220414-enlocale:en-usos:windows10-1703-x64system -
submitted
03-08-2022 06:24
Static task
static1
Behavioral task
behavioral1
Sample
pack2.zip
Resource
win10-20220718-en
Behavioral task
behavioral2
Sample
pack2.zip
Resource
win10v2004-20220721-en
Behavioral task
behavioral3
Sample
1.bat
Resource
win10-20220414-en
Behavioral task
behavioral4
Sample
1.bat
Resource
win10v2004-20220721-en
Behavioral task
behavioral5
Sample
ScannedDocuments_8080655.lnk
Resource
win10-20220414-en
Behavioral task
behavioral6
Sample
ScannedDocuments_8080655.lnk
Resource
win10v2004-20220721-en
Behavioral task
behavioral7
Sample
documents.lnk
Resource
win10-20220414-en
Behavioral task
behavioral8
Sample
documents.lnk
Resource
win10v2004-20220721-en
Behavioral task
behavioral9
Sample
kon4an.dll
Resource
win10-20220718-en
Behavioral task
behavioral10
Sample
kon4an.dll
Resource
win10v2004-20220721-en
Behavioral task
behavioral11
Sample
local.dll
Resource
win10-20220718-en
General
-
Target
documents.lnk
-
Size
2KB
-
MD5
890e24b463f18b1d0b3768ab9f591c56
-
SHA1
cd8247ba5494a483438c23dbfc144ba6134cb292
-
SHA256
2f9a1948f05e7089217fa9a2f4b6e9ad937ff23f503a68994cb0481f21699dff
-
SHA512
a72c653f57058bd50321fdc1a6fa92d16b3b060f7b40ddf0660da9d2821ddecc179be99a7b75ca885cd113cf92b8c0150c4eaf077a090952fc323fe47f4176eb
Malware Config
Extracted
icedid
380031663
sortswiminboard.com
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 3 1564 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1564 rundll32.exe 1564 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.execmd.execmd.exedescription pid process target process PID 1020 wrote to memory of 1276 1020 cmd.exe cmd.exe PID 1020 wrote to memory of 1276 1020 cmd.exe cmd.exe PID 1276 wrote to memory of 3712 1276 cmd.exe cmd.exe PID 1276 wrote to memory of 3712 1276 cmd.exe cmd.exe PID 3712 wrote to memory of 1564 3712 cmd.exe rundll32.exe PID 3712 wrote to memory of 1564 3712 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\documents.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C start 1.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K 1.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exeRunDll32 kon4an.dll, PluginInit4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses