Analysis
-
max time kernel
125s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
23-02-2022 21:59
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
tmp.exe
-
Size
699KB
-
MD5
4b71805d51193b0dbe39321475ba41ed
-
SHA1
2c69d33ee6cad5557f088f205f7c031b5d7d003c
-
SHA256
a98112f55dfd1fe971be934510d681e30fad6bc0edd9b4ba5c888f0080a5ed68
-
SHA512
9f882d0a3117c9b530bdcea67b36601a26024cfa0d505cfa0e06c4a2b675751ad453f220329b1cc8171fedfb576d73d58d8e13e726af08344307a257d078c608
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
2715004312
C2
badgoodreason.com
Signatures
-
IcedID First Stage Loader 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5112-133-0x000001F063B00000-0x000001F063B0B000-memory.dmp IcedidFirstLoader -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
tmp.exepid process 5112 tmp.exe 5112 tmp.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
tmp.exepid process 5112 tmp.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5112-133-0x000001F063B00000-0x000001F063B0B000-memory.dmpFilesize
44KB