Analysis
-
max time kernel
4294177s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
07-03-2022 12:20
Static task
static1
Behavioral task
behavioral1
Sample
135b57e035af5443eefdf0295d4ce484f3c457e998b31d68475f967bd7987f8b.dll
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
General
-
Target
135b57e035af5443eefdf0295d4ce484f3c457e998b31d68475f967bd7987f8b.dll
-
Size
226KB
-
MD5
f11d36af7de031ec74c1dc88463fbcc8
-
SHA1
d60350b69f6793c228132b0b3f6a5d9d5741f5e8
-
SHA256
135b57e035af5443eefdf0295d4ce484f3c457e998b31d68475f967bd7987f8b
-
SHA512
b4e5bf681c7624622cd937258af9b6465b837b89c12be3fa552103e4cd1744f2fd57ef7a63ecdbd2bc25e1c63fd174d91ed6fe41446bb712dde7010e69c35dd5
Malware Config
Signatures
-
IcedID First Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1712-56-0x0000000074430000-0x000000007447C000-memory.dmp IcedidFirstLoader behavioral1/memory/1712-58-0x0000000074430000-0x0000000074436000-memory.dmp IcedidFirstLoader -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 308 wrote to memory of 1712 308 regsvr32.exe regsvr32.exe PID 308 wrote to memory of 1712 308 regsvr32.exe regsvr32.exe PID 308 wrote to memory of 1712 308 regsvr32.exe regsvr32.exe PID 308 wrote to memory of 1712 308 regsvr32.exe regsvr32.exe PID 308 wrote to memory of 1712 308 regsvr32.exe regsvr32.exe PID 308 wrote to memory of 1712 308 regsvr32.exe regsvr32.exe PID 308 wrote to memory of 1712 308 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\135b57e035af5443eefdf0295d4ce484f3c457e998b31d68475f967bd7987f8b.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\135b57e035af5443eefdf0295d4ce484f3c457e998b31d68475f967bd7987f8b.dll2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/308-54-0x000007FEFB871000-0x000007FEFB873000-memory.dmpFilesize
8KB
-
memory/1712-55-0x0000000074E31000-0x0000000074E33000-memory.dmpFilesize
8KB
-
memory/1712-56-0x0000000074430000-0x000000007447C000-memory.dmpFilesize
304KB
-
memory/1712-57-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/1712-58-0x0000000074430000-0x0000000074436000-memory.dmpFilesize
24KB