Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 03:10
Static task
static1
Behavioral task
behavioral1
Sample
core.bat
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
core.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
pigeon64.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
pigeon64.dll
Resource
win10v2004-20241007-en
General
-
Target
core.bat
-
Size
184B
-
MD5
2b4f27b826aec08eb90ff784b25d048d
-
SHA1
b1444548b53ec112797cc7d03a1e227fe71315ca
-
SHA256
b976471778c3abead8001c5a7db7d39b461e88bbd5322a579d86c1ca725375fb
-
SHA512
d6316825b5372e445941b75b08b04aaee49bab12d752dba4691aac8093100d1632a1b07e6b7d6899c528e6777f0bcfcd977e02a7f8d559b29e205703f573d434
Malware Config
Extracted
icedid
1217670233
nnelforwfin.top
lakogrefop.rest
hangetilin.top
follytresh.co
-
auth_var
12
-
url_path
/posts/
Extracted
icedid
Signatures
-
Icedid family
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe 3656 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4776 wrote to memory of 3656 4776 cmd.exe 84 PID 4776 wrote to memory of 3656 4776 cmd.exe 84 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\pigeon64.dat,DllMain /i="license.dat"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3656
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
333KB
MD5b03af34cc11c8bd53afd958c839dd59f
SHA1d9c90d8f770be66850ea0734580867c16d64b404
SHA25671c9c15896b027fd830423f6226587bdad3f09681799bf3e69abb0479f18a853
SHA512c33204f04a99272a1619a4fe6e3ba5e128c437968f8f570c12ffbf20a71e2b617535a70bf51f9d4ddcccc7f44804a13a4528ece4470e4ee53273ad1806313911