Analysis
-
max time kernel
134s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2022 23:47
Behavioral task
behavioral1
Sample
challenge-files/challenge-files/collectionBoxConst.dll
Resource
win7-20220901-en
windows7-x64
2 signatures
150 seconds
General
-
Target
challenge-files/challenge-files/collectionBoxConst.dll
-
Size
538KB
-
MD5
65641f6498b6f94b0bdeb886e448d460
-
SHA1
b17591ec88cccf664f911f6e8a235e082e6bd892
-
SHA256
51658887e46c88ed6d5861861a55c989d256a7962fb848fe833096ed6b049441
-
SHA512
3896899d6c80de9dd383d15dde246a4478e94b72b7c780da9a3b4e2068aac85929b8665fbe8055ca9d1586c93fc1a7cc4dbdacf47cb3b3079d1830853ba9041c
-
SSDEEP
6144:8DLTDShETtXZAngMPZQn41hGEn1qaM8nOD4E8ONTxyohggJXZrO:8PTDS6TvfImgBe8nO4oZG
Malware Config
Extracted
Family
icedid
Campaign
548569227
C2
supplementik.top
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 78 1112 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
regsvr32.exerundll32.exepid process 4648 regsvr32.exe 4648 regsvr32.exe 1112 rundll32.exe 1112 rundll32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
cmd.exedescription pid process target process PID 1388 wrote to memory of 1112 1388 cmd.exe rundll32.exe PID 1388 wrote to memory of 1112 1388 cmd.exe rundll32.exe PID 1388 wrote to memory of 4516 1388 cmd.exe rundll32.exe PID 1388 wrote to memory of 4516 1388 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\challenge-files\challenge-files\collectionBoxConst.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\challenge-files\challenge-files\collectionBoxConst.dll",PluginInit2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\challenge-files\challenge-files\collectionBoxConst.dll"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1112-133-0x0000000000000000-mapping.dmp
-
memory/1112-134-0x000001EC91340000-0x000001EC91347000-memory.dmpFilesize
28KB
-
memory/1112-135-0x000001EC91340000-0x000001EC91347000-memory.dmpFilesize
28KB
-
memory/4516-136-0x0000000000000000-mapping.dmp
-
memory/4648-132-0x0000000002BF0000-0x0000000002BF7000-memory.dmpFilesize
28KB