Static task
static1
Behavioral task
behavioral1
Sample
1068-56-0x00000000000B0000-0x00000000000BA000-memory.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
1068-56-0x00000000000B0000-0x00000000000BA000-memory.dll
Resource
win10v2004-en-20220112
General
-
Target
1068-56-0x00000000000B0000-0x00000000000BA000-memory.dmp
-
Size
40KB
-
MD5
0d3d475bf64bef98334735d4f7fd90dc
-
SHA1
b567b78afe9744a4bd2de8407d9ddaceb4a14c4a
-
SHA256
15d323764f3deb22ad43702c2d98a1ae2ac0c94144d9b58b5bd4b718c3e9766e
-
SHA512
d17eeef0582824c90bd167f2628bc053bc88e103f67008fbfba53d42af29df83ad80be5ac5ec40540ae5ab5b22878d18f0b98f0988eca5415ff50687da061d30
-
SSDEEP
384:LnOKO6Y7MzPA8+5aAk617tBmgnvSYUGS3:SKVPzY3MjKt7EH
Malware Config
Extracted
icedid
1732687004
keepfootbal.com
Signatures
-
Icedid family
Files
-
1068-56-0x00000000000B0000-0x00000000000BA000-memory.dmp.dll windows x64
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.c Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 6B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.r Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.d Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE