Analysis
-
max time kernel
4294184s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
19-03-2022 08:21
Static task
static1
Behavioral task
behavioral1
Sample
c81699ff6c94281b101d5cd48e59b1cd25675b208532c3dc22d4891480e73558.dll
Resource
win7-20220311-en
0 signatures
0 seconds
General
-
Target
c81699ff6c94281b101d5cd48e59b1cd25675b208532c3dc22d4891480e73558.dll
-
Size
278KB
-
MD5
c808403e0bede8113eac59aa719c37e0
-
SHA1
8237f94ba73da9b394fedd3f6f3b5bde5680bc65
-
SHA256
c81699ff6c94281b101d5cd48e59b1cd25675b208532c3dc22d4891480e73558
-
SHA512
5248506b11c37338f6bb57aaff6fd43e8e7cdef84eef7c1e0db1eff0b2922ee66b31159408b907fff8be685ff070a511499d79985d3e4352744efd23509526b1
Malware Config
Extracted
Family
icedid
Signatures
-
IcedID First Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1060-56-0x0000000074100000-0x0000000074151000-memory.dmp IcedidFirstLoader behavioral1/memory/1060-58-0x0000000074100000-0x0000000074109000-memory.dmp IcedidFirstLoader -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1828 wrote to memory of 1060 1828 regsvr32.exe regsvr32.exe PID 1828 wrote to memory of 1060 1828 regsvr32.exe regsvr32.exe PID 1828 wrote to memory of 1060 1828 regsvr32.exe regsvr32.exe PID 1828 wrote to memory of 1060 1828 regsvr32.exe regsvr32.exe PID 1828 wrote to memory of 1060 1828 regsvr32.exe regsvr32.exe PID 1828 wrote to memory of 1060 1828 regsvr32.exe regsvr32.exe PID 1828 wrote to memory of 1060 1828 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c81699ff6c94281b101d5cd48e59b1cd25675b208532c3dc22d4891480e73558.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\c81699ff6c94281b101d5cd48e59b1cd25675b208532c3dc22d4891480e73558.dll2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1060-55-0x0000000075081000-0x0000000075083000-memory.dmpFilesize
8KB
-
memory/1060-57-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/1060-56-0x0000000074100000-0x0000000074151000-memory.dmpFilesize
324KB
-
memory/1060-58-0x0000000074100000-0x0000000074109000-memory.dmpFilesize
36KB
-
memory/1828-54-0x000007FEFB551000-0x000007FEFB553000-memory.dmpFilesize
8KB