Analysis
-
max time kernel
133s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
10-01-2023 21:14
Static task
static1
Behavioral task
behavioral1
Sample
request_01-10_INV-105.zip
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
request_01-10_INV-105.zip
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
request_01-10_INV-105.iso
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
request_01-10_INV-105.iso
Resource
win10v2004-20220812-en
General
-
Target
request_01-10_INV-105.zip
-
Size
310KB
-
MD5
ea29a3a9b2f1b0ca1375a03d1ebbf72a
-
SHA1
293e4b647425832907737984a2bb297d6244f200
-
SHA256
111b27216b69c27153a8725cc843e581289c4c61478bc5ab63018cbbcb0d1b30
-
SHA512
15a0d8e7552632a9caeeba74b90c218f9a5b65d3b08e93c886f95e5d087b743a3f950d28c74c82cdd6390b8282d9a6ead947961f9528072fb808dd8817ac774a
-
SSDEEP
6144:c04p3AvFK8dEDxghT+nRSV+IL55IRtD5hrzyfe/q:mp3AHGlgh6ZUrIP7Oyq
Malware Config
Extracted
icedid
1421378695
ebothlips.com
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 46 4476 rundll32.exe 52 4476 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4476 rundll32.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
cmd.execmd.exedescription ioc process File opened (read-only) \??\E: cmd.exe File opened (read-only) \??\E: cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 4476 rundll32.exe 4476 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 1692 wrote to memory of 1560 1692 cmd.exe xcopy.exe PID 1692 wrote to memory of 1560 1692 cmd.exe xcopy.exe PID 1692 wrote to memory of 4476 1692 cmd.exe rundll32.exe PID 1692 wrote to memory of 4476 1692 cmd.exe rundll32.exe PID 4636 wrote to memory of 4048 4636 cmd.exe xcopy.exe PID 4636 wrote to memory of 4048 4636 cmd.exe xcopy.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\request_01-10_INV-105.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sunpalhubE\rampewcadL.cmd A B C D E F G H I J K L M N O P O R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 91⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\xcopy.exexcopy /s /i /e /h sunpalhubE\unfaltering.dat C:\Users\Admin\AppData\Local\Temp\*2⤵
-
C:\Windows\system32\rundll32.exerundll32 C:\Users\Admin\AppData\Local\Temp\unfaltering.dat,init2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sunpalhubE\rampewcadL.cmd A B C D E F G H I J K L M N O P O R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 91⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\xcopy.exexcopy /s /i /e /h sunpalhubE\unfaltering.dat C:\Users\Admin\AppData\Local\Temp\*2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\unfaltering.datFilesize
544KB
MD593787c6a5ba46605c0916be28ef52bf1
SHA1c786205da7660fa7f76a41ed26b8d1c6aff95044
SHA2562a07b1741dbf216a188938d0fec870f8395374f760c6bf452f0a0479e975b018
SHA512ade7b59752508a0abffd296a4abb780238b4ad39bfcb0333ba365b43ad9886929e97f0d64ce2c8fcd6cfb32572d0342f018cd88f6e55ea0822096eeedf5b8e4c
-
C:\Users\Admin\AppData\Local\Temp\unfaltering.datFilesize
544KB
MD593787c6a5ba46605c0916be28ef52bf1
SHA1c786205da7660fa7f76a41ed26b8d1c6aff95044
SHA2562a07b1741dbf216a188938d0fec870f8395374f760c6bf452f0a0479e975b018
SHA512ade7b59752508a0abffd296a4abb780238b4ad39bfcb0333ba365b43ad9886929e97f0d64ce2c8fcd6cfb32572d0342f018cd88f6e55ea0822096eeedf5b8e4c
-
memory/1560-132-0x0000000000000000-mapping.dmp
-
memory/4048-142-0x0000000000000000-mapping.dmp
-
memory/4476-133-0x0000000000000000-mapping.dmp
-
memory/4476-136-0x000002168B4C0000-0x000002168B4C9000-memory.dmpFilesize
36KB