e4f110ace5cc6e58d8959e08fe6d7680e78e653e9e4c1da80e9770e1acf63ac2 | Triage™

Analysis

max time kernel
64s
max time network
113s
platform
windows10_x64
resource
win10
submitted
17/07/2020, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IcedID (7).dll
Size 212KB
Sample200717-glppje6z8e
SHA256 e4f110ace5cc6e58d8959e08fe6d7680e78e653e9e4c1da80e9770e1acf63ac2
MD5 8d3ae23b223e2199ede13e576d5947c4
SHA1 06f7be9dbee777d8111c88686cc644fb2bf9b22a
SHA512 edd295eec1dbc8db3bc50f9dbfcca49f894c673e9d211db887618a44c6ee364823d09848b3bfc029925e051fdcdfdbd90436fe1fe82967ab2de743d1f4b8ff5c
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 3924	3912	rundll32.exe	67
PID 3912 wrote to memory of 3924	3912	rundll32.exe	67
PID 3912 wrote to memory of 3924	3912	rundll32.exe	67

Blacklisted process makes network request 11 IoCs

flow	pid	Process
4	3924	rundll32.exe
6	3924	rundll32.exe
7	3924	rundll32.exe
9	3924	rundll32.exe
11	3924	rundll32.exe
13	3924	rundll32.exe
15	3924	rundll32.exe
17	3924	rundll32.exe
19	3924	rundll32.exe
23	3924	rundll32.exe
25	3924	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3924	rundll32.exe
3924	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\IcedID (7).dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\IcedID (7).dll",#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads