Analysis
-
max time kernel
146s -
max time network
17s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-11-2020 11:27
Static task
static1
Behavioral task
behavioral1
Sample
9c0f49b48163abc96de821cc3166a2d3.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
9c0f49b48163abc96de821cc3166a2d3.exe
-
Size
734KB
-
MD5
e46cf65a152a11fa46a3bb9eded46c5e
-
SHA1
dbec37427a38d6b91b474cefa7fca04c9912c0ba
-
SHA256
a1d19e174b6d1e21d3d7ba65f5d3a33a21c904a3f2c174e4e24f671b3a093f82
-
SHA512
d461108aa4b6269c88e387c0e569a45961bfff11b3a8df40f0cca7e3ef455d293fd42361dcc931133b9f4890d9ee27092a258a49e678ad3d770fbb34c236c669
Malware Config
Extracted
Family
icedid
C2
kostacardsplayer.pro
kostafootball.info
countrylandlords.info
landiscloudlord.red
Signatures
-
IcedID Second Stage Loader 1 IoCs
Processes:
resource yara_rule behavioral1/memory/288-0-0x00000000001E0000-0x00000000001E5000-memory.dmp IcedidSecondLoader -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
9c0f49b48163abc96de821cc3166a2d3.exepid process 288 9c0f49b48163abc96de821cc3166a2d3.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/288-0-0x00000000001E0000-0x00000000001E5000-memory.dmpFilesize
20KB