Analysis
-
max time kernel
91s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
07-03-2022 12:20
Static task
static1
Behavioral task
behavioral1
Sample
135b57e035af5443eefdf0295d4ce484f3c457e998b31d68475f967bd7987f8b.dll
Resource
win7-20220223-en
0 signatures
0 seconds
General
-
Target
135b57e035af5443eefdf0295d4ce484f3c457e998b31d68475f967bd7987f8b.dll
-
Size
226KB
-
MD5
f11d36af7de031ec74c1dc88463fbcc8
-
SHA1
d60350b69f6793c228132b0b3f6a5d9d5741f5e8
-
SHA256
135b57e035af5443eefdf0295d4ce484f3c457e998b31d68475f967bd7987f8b
-
SHA512
b4e5bf681c7624622cd937258af9b6465b837b89c12be3fa552103e4cd1744f2fd57ef7a63ecdbd2bc25e1c63fd174d91ed6fe41446bb712dde7010e69c35dd5
Malware Config
Signatures
-
IcedID First Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral2/memory/748-130-0x0000000074F40000-0x0000000074F46000-memory.dmp IcedidFirstLoader behavioral2/memory/748-131-0x0000000074F40000-0x0000000074F8C000-memory.dmp IcedidFirstLoader -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 116 wrote to memory of 748 116 regsvr32.exe regsvr32.exe PID 116 wrote to memory of 748 116 regsvr32.exe regsvr32.exe PID 116 wrote to memory of 748 116 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\135b57e035af5443eefdf0295d4ce484f3c457e998b31d68475f967bd7987f8b.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\135b57e035af5443eefdf0295d4ce484f3c457e998b31d68475f967bd7987f8b.dll2⤵