Resubmissions

16-10-2023 18:04

231016-wnww4abd6w 10

16-10-2023 15:56

231016-tdcpcshh8v 1

Analysis

  • max time kernel
    147s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    16-10-2023 18:04

General

  • Target

    w0.log.dll

  • Size

    800KB

  • MD5

    5e28d3bdbb2970f2f5a57dd67b85c255

  • SHA1

    1be963d2108dc215b895f8e6fbb96c4bc50b1eff

  • SHA256

    82a01607ebdcaa73b9ff201ccb76780ad8de4a99dd3df026dcb71b0f007456ed

  • SHA512

    0ba2779d16573871f1fe490c2382ccb7e923b799c21bc3630c9680a60ae2d77116c05b4a50b714d2451568c0fea4ababa82eed1bda30a380600141266a20ba9a

  • SSDEEP

    6144:GhQd+ZW/3TvUCWysU2XN92nIMkS9yjygIL1ZaquKIwsjd5vRukMi/mf+0Hlqn//J:sEv9yjpIrH6BjfEkPmt+/bYujcpZ

Malware Config

Extracted

Family

icedid

Campaign

3828440134

C2

aptekoagraliy.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\w0.log.dll, scab /k haval462
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2420
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1892

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1268-1-0x0000000077482000-0x0000000077483000-memory.dmp

    Filesize

    4KB

  • memory/1268-2-0x0000000180000000-0x0000000180009000-memory.dmp

    Filesize

    36KB

  • memory/1268-9-0x0000000180000000-0x0000000180009000-memory.dmp

    Filesize

    36KB

  • memory/1268-10-0x0000000002750000-0x0000000002751000-memory.dmp

    Filesize

    4KB

  • memory/1892-11-0x0000000003F10000-0x0000000003F11000-memory.dmp

    Filesize

    4KB

  • memory/1892-12-0x0000000003F10000-0x0000000003F11000-memory.dmp

    Filesize

    4KB

  • memory/1892-16-0x0000000002B30000-0x0000000002B40000-memory.dmp

    Filesize

    64KB

  • memory/2420-0-0x0000000000130000-0x0000000000134000-memory.dmp

    Filesize

    16KB