Analysis
-
max time kernel
105s -
max time network
107s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
24-03-2021 15:35
Static task
static1
Behavioral task
behavioral1
Sample
c17078635f24d1824c393fc468b5c454.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c17078635f24d1824c393fc468b5c454.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
c17078635f24d1824c393fc468b5c454.dll
-
Size
79KB
-
MD5
c17078635f24d1824c393fc468b5c454
-
SHA1
2718756ed616f82bd3878645090d948d6418bf04
-
SHA256
7435f1e5e1de827770130ef33665506c7af76737eaa15f974ce133b5c2fd0ee4
-
SHA512
e57c144c47c47bcb2d8426e81f5009b30cddb9b09817a0b472431a0b9070f038bb61f78441ad6b6026bccf7edc9f670ab5485c773d0afa369877c2357e9ed763
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
1211238709
C2
912caporers.fun
Signatures
-
IcedID First Stage Loader 1 IoCs
Processes:
resource yara_rule behavioral1/memory/800-3-0x00000000001C0000-0x00000000001C7000-memory.dmp IcedidFirstLoader -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 800 regsvr32.exe 800 regsvr32.exe