Resubmissions
16-10-2023 15:02
231016-seepnshc51 1016-10-2023 14:55
231016-sasezaba44 116-10-2023 14:14
231016-rj9vyage8y 1Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
16-10-2023 15:02
Static task
static1
Behavioral task
behavioral1
Sample
mesoc.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
mesoc.dll
Resource
win10v2004-20230915-en
General
-
Target
mesoc.dll
-
Size
778KB
-
MD5
a443f1622069aab6d8939491859e7cdb
-
SHA1
f5dc559c1a1dfc96dd768f0bbe3036625784039c
-
SHA256
e87928fcddf13935c91a0b5577e28efd29bb6a5c1d98e5129dec63e231601053
-
SHA512
167c848eba8cf44b818484381e3bb2a4be009b95c7f3a0994e3a394cc3161345b0a79aa38466398f3aa710f538a4c67ca792fa5a431d8c153ca3bb10de5a9cb0
-
SSDEEP
6144:GhQd+ZW/3TvUCWysU2XN92nIMkS9yjygIL1ZaquKIwsjd5vRukMi/mf+0Hlqn//f:sEv9yjpIrH6BjfEkPmt+/bYujcpZ
Malware Config
Extracted
icedid
3828440134
aptekoagraliy.com
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
rundll32.exepid process 1896 rundll32.exe 1896 rundll32.exe 1896 rundll32.exe 1896 rundll32.exe 1896 rundll32.exe 1896 rundll32.exe 1260 1260 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 2316 explorer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1896 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
explorer.exedescription pid process Token: SeShutdownPrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
explorer.exepid process 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
explorer.exepid process 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.execmd.exedescription pid process target process PID 2932 wrote to memory of 2988 2932 rundll32.exe WerFault.exe PID 2932 wrote to memory of 2988 2932 rundll32.exe WerFault.exe PID 2932 wrote to memory of 2988 2932 rundll32.exe WerFault.exe PID 2804 wrote to memory of 1896 2804 cmd.exe rundll32.exe PID 2804 wrote to memory of 1896 2804 cmd.exe rundll32.exe PID 2804 wrote to memory of 1896 2804 cmd.exe rundll32.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\mesoc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2932 -s 1002⤵PID:2988
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\system32\rundll32.exerundll32 mesoc.dll scab /k haval4622⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1896
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2316