Overview

overview

10

Static

static

10

628-56-0x0...ry.dll

windows7_x64

3

628-56-0x0...ry.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    628-56-0x0000000000120000-0x000000000012A000-memory.dmp

  • Size

    40KB

  • Sample

    220207-sjtdmaddhp

  • MD5

    57285626c40ca3ccf51cf28e15fcf914

  • SHA1

    a9902ea223e5cdaf00f7d8472c77adfa4cbb0824

  • SHA256

    156021c8cc72c13435ff01affcee1b5b648c5ea93007aa5663eec80a16dd8131

  • SHA512

    bbe5169fafb4b6d999a911e765920412550c9aca5acb78cee7bb085fae4125f760f2b8fc4af1563e465bbc41f6c46bf02f70e95771f0db1624bcd0de9f582d56

Score
10/10
icedid1732687004

Malware Config

Extracted

Family

icedid

Campaign

1732687004

C2

keepfootbal.com

Targets

    • Target

      628-56-0x0000000000120000-0x000000000012A000-memory.dmp

    • Size

      40KB

    • MD5

      57285626c40ca3ccf51cf28e15fcf914

    • SHA1

      a9902ea223e5cdaf00f7d8472c77adfa4cbb0824

    • SHA256

      156021c8cc72c13435ff01affcee1b5b648c5ea93007aa5663eec80a16dd8131

    • SHA512

      bbe5169fafb4b6d999a911e765920412550c9aca5acb78cee7bb085fae4125f760f2b8fc4af1563e465bbc41f6c46bf02f70e95771f0db1624bcd0de9f582d56

    Score
    10/10

    • Suspicious use of NtCreateProcessExOtherParentProcess

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks