6fede71248803463757ea05e875e0cdb97d38245c0d28597639aa797a90987ce | Triage™

Analysis

max time kernel
127s
max time network
150s
platform
windows10_x64
resource
win10v200430
submitted
15/07/2020, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2020-07-14-DLL-for-IcedID-installer-example-15-of-18.bin.dll
Size 159KB
Sample200715-hhb6ma3ms2
SHA256 6fede71248803463757ea05e875e0cdb97d38245c0d28597639aa797a90987ce
MD5 5535e7340a1760af3dbc01fcc8f52378
SHA1 906c62992f0d44715ca940c6a08f0be5696d89f4
SHA512 09f33fca95748ed62716332a2e9dfc441d35fde39e7c2c956fcec16f37e26f1781b808d7a8b84c27b3091585acb238538b082f9bd992a413868dcf5280326661
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 1176	3216	rundll32.exe	68
PID 3216 wrote to memory of 1176	3216	rundll32.exe	68
PID 3216 wrote to memory of 1176	3216	rundll32.exe	68

Blacklisted process makes network request 4 IoCs

flow	pid	Process
7	1176	rundll32.exe
9	1176	rundll32.exe
11	1176	rundll32.exe
13	1176	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1176	rundll32.exe
1176	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2020-07-14-DLL-for-IcedID-installer-example-15-of-18.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2020-07-14-DLL-for-IcedID-installer-example-15-of-18.bin.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads