Analysis
-
max time kernel
11s -
max time network
102s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
23-03-2021 17:50
Static task
static1
Behavioral task
behavioral1
Sample
globalRemove.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
globalRemove.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
globalRemove.dll
-
Size
74KB
-
MD5
0d7337895bd6c00d9797235504b0bae6
-
SHA1
1d45ced100abecdcb4208358de37e52fdb7de1d4
-
SHA256
45cb789e50ac5222420b05653e25fd6af55785581d0b713b345d301a227798c5
-
SHA512
af11064fbb30ba6bd01a65ae3de0f41be1df50e3e41758fe9c8b6a6f95babd9f3042b46196f77d515a0cc19a8da910c40a3cd5cc8d36fa98f69523e4a6149cc0
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
1144128233
C2
40yrjobberz.space
Signatures
-
IcedID First Stage Loader 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4768-2-0x0000000001450000-0x0000000001457000-memory.dmp IcedidFirstLoader -
Processes:
resource yara_rule behavioral2/memory/4768-2-0x0000000001450000-0x0000000001457000-memory.dmp crime_win32_icedid_stage1 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 4768 regsvr32.exe 4768 regsvr32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4768-2-0x0000000001450000-0x0000000001457000-memory.dmpFilesize
28KB