Analysis
-
max time kernel
136s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12-10-2023 15:43
Static task
static1
Behavioral task
behavioral1
Sample
5e3bb62b44636f502e387d4c00bd5a7bc1d040332028238ccd812f73e6d859ca_JC.dll
Resource
win7-20230831-en
General
-
Target
5e3bb62b44636f502e387d4c00bd5a7bc1d040332028238ccd812f73e6d859ca_JC.dll
-
Size
328KB
-
MD5
bb7da19e0399724519724d44d7c331c7
-
SHA1
b10fb1c24b1d4187e24ee1be76b6247b862b214c
-
SHA256
5e3bb62b44636f502e387d4c00bd5a7bc1d040332028238ccd812f73e6d859ca
-
SHA512
b68e3f3fec30cac41a11a939e0a5e9db2e45574cb31201fb9dd92657cd03edc060df4f7026ce2f1d9617b48ac88769dcb67958aea040684e661be82d0f8f3fd9
-
SSDEEP
6144:yN/F41OWGRkFtwxW6spj/JbUaeboh6EReEUHFmUC3qS7e/g1j:y5FCOWGRayW6sAowXFmUy4U
Malware Config
Extracted
icedid
361893872
Signatures
-
Blocklisted process makes network request 5 IoCs
Processes:
rundll32.exeflow pid process 8 2616 rundll32.exe 10 2616 rundll32.exe 12 2616 rundll32.exe 19 2616 rundll32.exe 21 2616 rundll32.exe -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exepid process 2616 rundll32.exe 2616 rundll32.exe 2616 rundll32.exe 2616 rundll32.exe -
Modifies registry class 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\CLSID\{4254E45A-C9C2-6B17-47CD-F8DEB2E81452} rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\CLSID\{4254E45A-C9C2-6B17-47CD-F8DEB2E81452}\ = e863384a76f1e2589a2c43b5d77e74a45f8995d461cb8e90eddefac148ff382387dbc4edd20fc81f52581c247198c514cf0551cb47e22b7fa755a02803505421d4590b3cf1f320ad82e75e40ae6603ff15e4b9628ad03af0678b3d4750734736f4e984623c708c05488718d12f1737a0f53c0b45de687f1c6c7fa0581b55c05fd8983e49d2af30fb8da89492a38c93234ec7e631b711ee2929dd1747232142dd1d792a8bc2645044a78d3dd678a388a797d9234bbb506a23505ba5e2a08c34d4e5a53bf199a59923573adf9f395ccfbbfcfb73fc9026d1645db68a017bac0137741d485d4347c882a68bb51099831be3b4fcf8e46d5e34cbe26b244d1979908c99a90f63a48ba78b6ec779329b80ae0d7248ade8 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2304 regsvr32.exe 2304 regsvr32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.execmd.exedescription pid process target process PID 2304 wrote to memory of 2728 2304 regsvr32.exe cmd.exe PID 2304 wrote to memory of 2728 2304 regsvr32.exe cmd.exe PID 2304 wrote to memory of 2728 2304 regsvr32.exe cmd.exe PID 2728 wrote to memory of 2616 2728 cmd.exe rundll32.exe PID 2728 wrote to memory of 2616 2728 cmd.exe rundll32.exe PID 2728 wrote to memory of 2616 2728 cmd.exe rundll32.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5e3bb62b44636f502e387d4c00bd5a7bc1d040332028238ccd812f73e6d859ca_JC.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C rundll32.exe C:\Users\Admin\AppData\Roaming\ikvobd2\Admin\Ankukuacow64.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Roaming\ikvobd2\Admin\Ankukuacow64.dll,#13⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Modifies registry class
PID:2616
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e13e718fa34cf1f2c710e3c08f1d0f41
SHA1f28d593e021002256e42504050059b527d50569e
SHA2568552345cc90be38ec80c5f5147657afa1493df2f625dab7645e7bc0c4e36947f
SHA512e88558513ddd972bf6ea828b1ea8ed7912c02c262f8e0320650c264eb24e84537dfcdadcac22722f2ba705c75b3f6986d93eda981c3709807b4b5759385a45b8
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
583KB
MD50245e02cbb6ffe2716c2aeb7fb8006d0
SHA159dd3d2477211eb4fcd72b542812a2036fa0e1e8
SHA2565d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1
SHA5120c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82
-
Filesize
583KB
MD50245e02cbb6ffe2716c2aeb7fb8006d0
SHA159dd3d2477211eb4fcd72b542812a2036fa0e1e8
SHA2565d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1
SHA5120c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82
-
Filesize
583KB
MD50245e02cbb6ffe2716c2aeb7fb8006d0
SHA159dd3d2477211eb4fcd72b542812a2036fa0e1e8
SHA2565d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1
SHA5120c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82
-
Filesize
583KB
MD50245e02cbb6ffe2716c2aeb7fb8006d0
SHA159dd3d2477211eb4fcd72b542812a2036fa0e1e8
SHA2565d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1
SHA5120c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82
-
Filesize
583KB
MD50245e02cbb6ffe2716c2aeb7fb8006d0
SHA159dd3d2477211eb4fcd72b542812a2036fa0e1e8
SHA2565d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1
SHA5120c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82