Analysis
-
max time kernel
5s -
max time network
8s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
24-03-2021 17:37
Static task
static1
Behavioral task
behavioral1
Sample
c1dc5568cc35eb29ddd0584354906b50.dll
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c1dc5568cc35eb29ddd0584354906b50.dll
Resource
win10v20201028
0 signatures
0 seconds
General
-
Target
c1dc5568cc35eb29ddd0584354906b50.dll
-
Size
79KB
-
MD5
c1dc5568cc35eb29ddd0584354906b50
-
SHA1
cc3eeb97d572b05e3b99c49577c890f6bb2809a0
-
SHA256
6c98f6a695302a4a1477eddd22c5524c6bb766b6be905379c5e8a841f83b0af6
-
SHA512
6b4930e3e55330ca8aa5862b7633da21a29dec29d81280fd59c91790e47caf9f80f4fbef35d4936ee8117395a3009507a5cc74d2e8d94e6510ee92a51d1a2936
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
1211238709
C2
912caporers.fun
Signatures
-
IcedID First Stage Loader 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1888-3-0x00000000002B0000-0x00000000002B7000-memory.dmp IcedidFirstLoader -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 1888 regsvr32.exe 1888 regsvr32.exe