Overview
overview
10Static
static
pack2.zip
windows10-1703-x64
1pack2.zip
windows10-2004-x64
11.bat
windows10-1703-x64
101.bat
windows10-2004-x64
10ScannedDoc...55.lnk
windows10-1703-x64
3ScannedDoc...55.lnk
windows10-2004-x64
7documents.lnk
windows10-1703-x64
10documents.lnk
windows10-2004-x64
10kon4an.dll
windows10-1703-x64
1kon4an.dll
windows10-2004-x64
1local.dll
windows10-1703-x64
10local.dll
windows10-2004-x64
10Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
03-08-2022 06:24
Static task
static1
Behavioral task
behavioral1
Sample
pack2.zip
Resource
win10-20220718-en
Behavioral task
behavioral2
Sample
pack2.zip
Resource
win10v2004-20220721-en
Behavioral task
behavioral3
Sample
1.bat
Resource
win10-20220414-en
Behavioral task
behavioral4
Sample
1.bat
Resource
win10v2004-20220721-en
Behavioral task
behavioral5
Sample
ScannedDocuments_8080655.lnk
Resource
win10-20220414-en
Behavioral task
behavioral6
Sample
ScannedDocuments_8080655.lnk
Resource
win10v2004-20220721-en
Behavioral task
behavioral7
Sample
documents.lnk
Resource
win10-20220414-en
Behavioral task
behavioral8
Sample
documents.lnk
Resource
win10v2004-20220721-en
Behavioral task
behavioral9
Sample
kon4an.dll
Resource
win10-20220718-en
Behavioral task
behavioral10
Sample
kon4an.dll
Resource
win10v2004-20220721-en
Behavioral task
behavioral11
Sample
local.dll
Resource
win10-20220718-en
General
-
Target
documents.lnk
-
Size
2KB
-
MD5
890e24b463f18b1d0b3768ab9f591c56
-
SHA1
cd8247ba5494a483438c23dbfc144ba6134cb292
-
SHA256
2f9a1948f05e7089217fa9a2f4b6e9ad937ff23f503a68994cb0481f21699dff
-
SHA512
a72c653f57058bd50321fdc1a6fa92d16b3b060f7b40ddf0660da9d2821ddecc179be99a7b75ca885cd113cf92b8c0150c4eaf077a090952fc323fe47f4176eb
Malware Config
Extracted
icedid
380031663
sortswiminboard.com
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 20 3644 rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3644 rundll32.exe 3644 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.execmd.execmd.exedescription pid process target process PID 1964 wrote to memory of 216 1964 cmd.exe cmd.exe PID 1964 wrote to memory of 216 1964 cmd.exe cmd.exe PID 216 wrote to memory of 2176 216 cmd.exe cmd.exe PID 216 wrote to memory of 2176 216 cmd.exe cmd.exe PID 2176 wrote to memory of 3644 2176 cmd.exe rundll32.exe PID 2176 wrote to memory of 3644 2176 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\documents.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C start 1.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K 1.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exeRunDll32 kon4an.dll, PluginInit4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses