icedid | 940-54-0x0000000000310000-0x000000000031B000-memory[.]dmp | Triage

Sharing

General

Target

940-54-0x0000000000310000-0x000000000031B000-memory.dmp
Size

44KB
MD5

e6c67c91b745c256d2f372a30c3ae2ba
SHA1

21e2078b9133b8d8c083ac98413f576341a26e56
SHA256

64f59fde149334644b1e0932f7f9e430d2def0d8e0332f07abc55a3f0ef82400
SHA512

be3a049b65f912eb85358e7c186e7ee1541621e1f72b5cc4a37fb430e958bde52c77345f7bb2486a3a125a9a6f8080ffe882971e2adc77892f8c2a98b7159063

Score

10^/10

loader 712890712 icedid

Malware Config

Extracted

Family

icedid

Campaign

712890712

C2

fikasterwer.top

Signatures

IcedID First Stage Loader 2 IoCs

Processes:

resource	yara_rule
sample	IcedidFirstLoader
sample	IcedidFirstLoader

Icedid family
icedid

Files

940-54-0x0000000000310000-0x000000000031B000-memory.dmp
.exe windows x64

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.c
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 512B - Virtual size: 6B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.r
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.d
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE