Static task
static1
Behavioral task
behavioral1
Sample
628-56-0x0000000000120000-0x000000000012A000-memory.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
628-56-0x0000000000120000-0x000000000012A000-memory.dll
Resource
win10v2004-en-20220113
General
-
Target
628-56-0x0000000000120000-0x000000000012A000-memory.dmp
-
Size
40KB
-
MD5
57285626c40ca3ccf51cf28e15fcf914
-
SHA1
a9902ea223e5cdaf00f7d8472c77adfa4cbb0824
-
SHA256
156021c8cc72c13435ff01affcee1b5b648c5ea93007aa5663eec80a16dd8131
-
SHA512
bbe5169fafb4b6d999a911e765920412550c9aca5acb78cee7bb085fae4125f760f2b8fc4af1563e465bbc41f6c46bf02f70e95771f0db1624bcd0de9f582d56
-
SSDEEP
384:LnOKO6Y7MzPA8+5aAk617tBmgXvSYUGS3:SKVPzY3MjKtbEH
Malware Config
Extracted
icedid
1732687004
keepfootbal.com
Signatures
-
Icedid family
Files
-
628-56-0x0000000000120000-0x000000000012A000-memory.dmp.dll windows x64
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.c Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 6B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.r Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.d Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE