Analysis
-
max time kernel
135s -
max time network
139s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
20-11-2020 00:59
Static task
static1
Behavioral task
behavioral1
Sample
noosbt.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
noosbt.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
noosbt.dll
-
Size
310KB
-
MD5
f72d55d55636f7f84f2fd765c911877e
-
SHA1
c238e43e86e69540f4c04b9f1b10b167d7a9540b
-
SHA256
c7a41aaae47af9ebc6bcabb267e1d11d903c937df275ab2bbdcda734efdbabbf
-
SHA512
b7724ada1790374a1fdf85f090aa5faf37d70010069f2d5e426473b0e36feb29c256d49f90cc59d912ebc3bb22228a267b41a79d3be258807b7290dcf2888fb8
Malware Config
Signatures
-
IcedID Core Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1904-1-0x0000000002CA0000-0x0000000002D46000-memory.dmp Icedid_core -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 344 wrote to memory of 1904 344 regsvr32.exe regsvr32.exe PID 344 wrote to memory of 1904 344 regsvr32.exe regsvr32.exe PID 344 wrote to memory of 1904 344 regsvr32.exe regsvr32.exe PID 344 wrote to memory of 1904 344 regsvr32.exe regsvr32.exe PID 344 wrote to memory of 1904 344 regsvr32.exe regsvr32.exe PID 344 wrote to memory of 1904 344 regsvr32.exe regsvr32.exe PID 344 wrote to memory of 1904 344 regsvr32.exe regsvr32.exe