Analysis
-
max time kernel
90s -
max time network
93s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
01-04-2021 18:43
Static task
static1
Behavioral task
behavioral1
Sample
5264623f5d44ca9a2ff057eb5ca58fefa48b0cc7a0b31f7fd13eb103b3314376.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5264623f5d44ca9a2ff057eb5ca58fefa48b0cc7a0b31f7fd13eb103b3314376.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
5264623f5d44ca9a2ff057eb5ca58fefa48b0cc7a0b31f7fd13eb103b3314376.dll
-
Size
198KB
-
MD5
fc032140a0e8c90fd81041cde44acdec
-
SHA1
630408c1b09fc6b1af1c475d95951260df4bdfc9
-
SHA256
5264623f5d44ca9a2ff057eb5ca58fefa48b0cc7a0b31f7fd13eb103b3314376
-
SHA512
6bca07d59ea1e77b535eea62b18052540f7ad8b7dabf703fae1dd3408edcdf11ef69a9374fca60064f951dbaa8f10dd0949c596654e6cb4b20daadb26cc991c8
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
1584008337
C2
secondpilots.space
Signatures
-
IcedID First Stage Loader 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1596-3-0x00000000003B0000-0x00000000003B7000-memory.dmp IcedidFirstLoader -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 1596 regsvr32.exe 1596 regsvr32.exe