2ea61a28711cd9ac50e849c85c041faf5799e306beedaf0444df3a00a4aa0ea6 | Triage™

Analysis

max time kernel
147s
max time network
74s
platform
windows10_x64
resource
win10v200430
submitted
15/07/2020, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2020-07-14-DLL-for-IcedID-installer-example-09-of-18.bin.dll
Size 159KB
Sample200715-bymb2fket6
SHA256 2ea61a28711cd9ac50e849c85c041faf5799e306beedaf0444df3a00a4aa0ea6
MD5 d20786bb2c1147adc9695c0049fa448c
SHA1 e13dca371bbc831122299edf35f549372740dc3c
SHA512 e23dd6601811edd7b80f7a4649b4906e008be8f9099d85b512dcbc216c77f9cefb4ec40047f1d890f77c0d44f1ba2c561c321025688a17e8730db1de8652e66b
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 4064	3692	rundll32.exe	66
PID 3692 wrote to memory of 4064	3692	rundll32.exe	66
PID 3692 wrote to memory of 4064	3692	rundll32.exe	66

Blacklisted process makes network request 4 IoCs

flow	pid	Process
7	4064	rundll32.exe
9	4064	rundll32.exe
13	4064	rundll32.exe
15	4064	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4064	rundll32.exe
4064	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2020-07-14-DLL-for-IcedID-installer-example-09-of-18.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2020-07-14-DLL-for-IcedID-installer-example-09-of-18.bin.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:4064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads