Analysis
-
max time kernel
56s -
max time network
118s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
24-11-2020 14:55
Static task
static1
Behavioral task
behavioral1
Sample
Accesshover.dat.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Accesshover.dat.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
Accesshover.dat.dll
-
Size
105KB
-
MD5
8dccd1c176f6b855e1a60b710d38a9e4
-
SHA1
3b72fecbabd585947cd9cf4b5d9c3795ab798d39
-
SHA256
6610a12184a15e0fe2f3c8d2f730aa7a4497386a10487138cfe1e019ec3f1f2a
-
SHA512
6f743e1769624af220d54b5d1cba4e02f8868338c7503f311bad631af4ecc8983d75ad7ae953b71a973796e2669e9a2ef451459c836b7a917f7a175dc87cb5ff
Malware Config
Signatures
-
IcedID Core Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1960-1-0x0000000002C20000-0x0000000002CC6000-memory.dmp Icedid_core -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1668 wrote to memory of 1960 1668 regsvr32.exe regsvr32.exe PID 1668 wrote to memory of 1960 1668 regsvr32.exe regsvr32.exe PID 1668 wrote to memory of 1960 1668 regsvr32.exe regsvr32.exe PID 1668 wrote to memory of 1960 1668 regsvr32.exe regsvr32.exe PID 1668 wrote to memory of 1960 1668 regsvr32.exe regsvr32.exe PID 1668 wrote to memory of 1960 1668 regsvr32.exe regsvr32.exe PID 1668 wrote to memory of 1960 1668 regsvr32.exe regsvr32.exe