Static task
static1
Behavioral task
behavioral1
Sample
976-56-0x0000000000130000-0x000000000013A000-memory.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
976-56-0x0000000000130000-0x000000000013A000-memory.dll
Resource
win10v2004-en-20220113
General
-
Target
976-56-0x0000000000130000-0x000000000013A000-memory.dmp
-
Size
40KB
-
MD5
534bf8c0f11fc540d7b11790351561bc
-
SHA1
6b9393f60d476fddd617b9ada7b151b167218993
-
SHA256
44799d1df8d40de415ebce0501a6d4b91470e364d730f16bb5be04b94d167763
-
SHA512
13803e52e4b1c2a7c85d7f0e0ce713b7db73a4a90f08e1c23316bda88863729e814e500c27e74bac82173c7ce793cd0b7bb562d58f1220fec4dbd79fcb0cf291
-
SSDEEP
384:LnOKO6Y7MzPA8+5aAk617tBmgdvSYUGS3:SKVPzY3MjKtZEH
Malware Config
Extracted
icedid
1732687004
keepfootbal.com
Signatures
-
Icedid family
Files
-
976-56-0x0000000000130000-0x000000000013A000-memory.dmp.dll windows x64
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.c Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 6B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.r Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.d Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE