Analysis
-
max time kernel
4294213s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
19-03-2022 10:20
Static task
static1
Behavioral task
behavioral1
Sample
a543a602e4e52353b09ff26067fa4e57a5814ad86926e23fbb495d8ae962c828.dll
Resource
win7-20220311-en
0 signatures
0 seconds
General
-
Target
a543a602e4e52353b09ff26067fa4e57a5814ad86926e23fbb495d8ae962c828.dll
-
Size
316KB
-
MD5
a6b0eb63736bcc5a60dced2ae8213712
-
SHA1
6772df00c0c46dd2183d57885f6d838b1593555f
-
SHA256
a543a602e4e52353b09ff26067fa4e57a5814ad86926e23fbb495d8ae962c828
-
SHA512
8d4e14818a40ee103e39c771ddb34107a6de59d7755070fea63f8d918adf59de31b7a17c3a903796202b03c6c6c6bfda876e61970af89af20687c251756b2218
Malware Config
Extracted
Family
icedid
C2
marcingranio.cyou
marzingranocny.top
Signatures
-
IcedID Second Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1016-55-0x0000000074D50000-0x0000000074D56000-memory.dmp IcedidSecondLoader behavioral1/memory/1016-56-0x0000000074D50000-0x0000000074DAC000-memory.dmp IcedidSecondLoader -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 628 wrote to memory of 1016 628 rundll32.exe rundll32.exe PID 628 wrote to memory of 1016 628 rundll32.exe rundll32.exe PID 628 wrote to memory of 1016 628 rundll32.exe rundll32.exe PID 628 wrote to memory of 1016 628 rundll32.exe rundll32.exe PID 628 wrote to memory of 1016 628 rundll32.exe rundll32.exe PID 628 wrote to memory of 1016 628 rundll32.exe rundll32.exe PID 628 wrote to memory of 1016 628 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a543a602e4e52353b09ff26067fa4e57a5814ad86926e23fbb495d8ae962c828.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a543a602e4e52353b09ff26067fa4e57a5814ad86926e23fbb495d8ae962c828.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1016-54-0x0000000075471000-0x0000000075473000-memory.dmpFilesize
8KB
-
memory/1016-55-0x0000000074D50000-0x0000000074D56000-memory.dmpFilesize
24KB
-
memory/1016-56-0x0000000074D50000-0x0000000074DAC000-memory.dmpFilesize
368KB
-
memory/1016-57-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB