e9e643722767e6dc2458c66e61f6a1ea1aba915bdc52058b06eb89a29aa8fec8 | Triage™

Analysis

max time kernel
109s
max time network
131s
platform
windows10_x64
resource
win10v200430
submitted
17/07/2020, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IcedID (2).dll
Size 204KB
Sample200717-vhtwvsg3jj
SHA256 e9e643722767e6dc2458c66e61f6a1ea1aba915bdc52058b06eb89a29aa8fec8
MD5 2fd6cd0933c0680e4e7cccb4ec1369c2
SHA1 4694468f1864386bd916b8357a15efc7138d957f
SHA512 3880c6d5a727f206dd7f015488153ce731900de689880df4d9d6507b7a64ac64e6396a5c7499731a40476b0931665b5f6ef459a31a2e48e2635f0dc373fb1c0a
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2144	rundll32.exe
2144	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2144	2416	rundll32.exe	68
PID 2416 wrote to memory of 2144	2416	rundll32.exe	68
PID 2416 wrote to memory of 2144	2416	rundll32.exe	68

Blacklisted process makes network request 11 IoCs

flow	pid	Process
6	2144	rundll32.exe
8	2144	rundll32.exe
9	2144	rundll32.exe
11	2144	rundll32.exe
13	2144	rundll32.exe
15	2144	rundll32.exe
17	2144	rundll32.exe
19	2144	rundll32.exe
21	2144	rundll32.exe
23	2144	rundll32.exe
25	2144	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\IcedID (2).dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\IcedID (2).dll",#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Blacklisted process makes network request
  PID:2144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads