c1a91bfb28f0b216ccb04c7b704dfb4167a2e498cbd4c10bb954529608033aba | Triage™

Analysis

max time kernel
115s
max time network
118s
platform
windows10_x64
resource
win10
submitted
15/07/2020, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2020-07-14-DLL-for-IcedID-installer-example-10-of-18.bin.dll
Size 159KB
Sample200715-l6c3xj9d8a
SHA256 c1a91bfb28f0b216ccb04c7b704dfb4167a2e498cbd4c10bb954529608033aba
MD5 d9a869685c880855269e72d87840c827
SHA1 fad901167f109971c9daed41d69a0120611d22cd
SHA512 38075f58f13a727ce789f8dec0bf5bf30d79f280233124b7b56b714901774c09892bd6c51708eabb283f0a1dd93cf772b3f296e51b8944a8eb665c63379adfc7
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 3860	3384	rundll32.exe	67
PID 3384 wrote to memory of 3860	3384	rundll32.exe	67
PID 3384 wrote to memory of 3860	3384	rundll32.exe	67

Blacklisted process makes network request 4 IoCs

flow	pid	Process
5	3860	rundll32.exe
7	3860	rundll32.exe
12	3860	rundll32.exe
14	3860	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3860	rundll32.exe
3860	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2020-07-14-DLL-for-IcedID-installer-example-10-of-18.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2020-07-14-DLL-for-IcedID-installer-example-10-of-18.bin.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads