Analysis
-
max time kernel
241s -
max time network
244s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2022 18:59
Static task
static1
Behavioral task
behavioral1
Sample
Invoi_PDF.lnk
Resource
win10v2004-20220901-en
Behavioral task
behavioral2
Sample
cadets/braved.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
cadets/timberedShear.cmd
Resource
win10v2004-20220812-en
Behavioral task
behavioral4
Sample
cadets/unerringlyOffering.js
Resource
win10v2004-20220901-en
General
-
Target
cadets/braved.dll
-
Size
476KB
-
MD5
41e60934b4352378f755b8b234e28b1d
-
SHA1
596520cd20a9abf62119c3e3d530e5e99f9dd285
-
SHA256
5b3ec3844cc7a448071397b8cb488e6b1dd8a35eb66a6046672cf243817f0b03
-
SHA512
e41cae897b3e4c6b5e228940933a5120d175d39c5939ba9f7a6739d70f6ef0cd71fc7d8302c6d28989be2a1959aaa201265ed28717d093e5d04451567dcbf307
-
SSDEEP
6144:EowRmpalgwWrQk2wT7Byq1i6qZksSiOmvQeQEer:XwUpalgwbtq7sq1i6qqsSIjer
Malware Config
Extracted
icedid
3228182693
tezycronam.com
Signatures
-
Blocklisted process makes network request 5 IoCs
Processes:
rundll32.exeflow pid process 2 636 rundll32.exe 35 636 rundll32.exe 41 636 rundll32.exe 42 636 rundll32.exe 43 636 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 636 rundll32.exe 636 rundll32.exe