Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 21:17
Static task
static1
Behavioral task
behavioral1
Sample
candyx32.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
candyx32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
core.bat
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
core.bat
Resource
win10v2004-20241007-en
General
-
Target
core.bat
-
Size
184B
-
MD5
8e8c8dd91722dd16c50d410e921dfca2
-
SHA1
62524925b4f9c124d244aa9c42109877f36ff3fe
-
SHA256
4e46bcf388758863f9938fb095521c0bfb5c8f41942341f3a6aa0e0e48e7672d
-
SHA512
90de5ed56e2fdaa1d69315a19e1d6242b0ff5f6e41347893f98d02bf3f78a31cc954f8a193ca94e93942178928ddc5dc303bbce9bd4fde869032ea32831c6a4e
Malware Config
Extracted
icedid
302245654
imilarquestio.top
heywanted.top
minimike.quest
alsohavethis.top
-
auth_var
5
-
url_path
/posts/
Extracted
icedid
Signatures
-
Icedid family
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1840 1760 cmd.exe 83 PID 1760 wrote to memory of 1840 1760 cmd.exe 83 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\candyx32.dat,DllMain /i="license.dat"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1840
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
333KB
MD5c7c45636ca690acdab7fba1e9d126f8b
SHA161376304cd90786813a80680a92cef03fedb6484
SHA256cfc202b44509f2f607d365858a8218dfdc6b26f8087efcc5e46f4fef9ab53705
SHA5129e6c7df9f70017b9eeb5868a358bc9eaf50de65dad04640220f380ff72e80bc303f034cb62929abb0c35d951b751732a131ae828c4c01cd1826610423f784db8