Analysis
-
max time kernel
144s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
24-03-2022 19:22
Static task
static1
Behavioral task
behavioral1
Sample
893f1615c8e7470900225101a56bd29e4e5b8047f1fc707d51a13dfe9629b32e.dll
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
General
-
Target
893f1615c8e7470900225101a56bd29e4e5b8047f1fc707d51a13dfe9629b32e.dll
-
Size
180KB
-
MD5
f4cd44721385fe004497dbb42fb2a237
-
SHA1
66e7c0815f3ca18814040e932f35673963e94353
-
SHA256
893f1615c8e7470900225101a56bd29e4e5b8047f1fc707d51a13dfe9629b32e
-
SHA512
2fe1b2c27e3bcf4a65c8cbf345b65c7edc2821fa19f8012c1a4dad02986f27028193847926f09d916735505eb25becac60d1037fa154134a519b1a2bdf93f2fb
Malware Config
Extracted
Family
icedid
Signatures
-
IcedID First Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4068-135-0x0000000074BE0000-0x0000000074C17000-memory.dmp IcedidFirstLoader behavioral2/memory/4068-136-0x0000000074BE0000-0x0000000074BE9000-memory.dmp IcedidFirstLoader -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3676 4068 WerFault.exe rundll32.exe -
Modifies data under HKEY_USERS 6 IoCs
Processes:
svchost.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\00188006B9806431 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e0000000002000000000010660000000100002000000057b491c00fd50e5d7f253ec57718a7834173612fdebd18ac3d4423b0da8e19fa000000000e800000000200002000000000a985077ca0d8c2aa4f79047772b5c387521fb2fac2629640a7901c853ace03800000006f0181dddfb9235e54b3c2ee501971520bb067471ebc814b235de5e9329f51c2f6e314d22ed696f5deaf89a5b3a9b75465b83c55d2d6e53bce3067ad876b033303a17915a66be4ee1fc60468bed60ae7617a1199e4f92a76323bdd9f9051c823a3f0529aae9a4e9a77c40d11437d4cfae5ccf9d03440a0707ad60ea9acdecc7c40000000d5f072482a4ebcb87859edd5417d9db918df3687b362bfd980909f6e9ff99510bce39eeb23c4ce4cb6add45035dfee4256efe63f389256b37a04e459556ec791 svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5} svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e0000000002000000000010660000000100002000000050edc60a3da121a4069c77323ee22685afea53dfd870a0a9e5cae05bde9be46f000000000e8000000002000020000000617f14f93ae4a39d6ce08e0ed570e3b74855e905fd79f270fc88d655a0d00282100d0000eb652cf72755b46c948eb453ab8b8e3e8494049b2d3570b893c1c44791e22b7bc06fcb81ff3104538d47c2ce236c6c2982b77927575cd7a86a91037833d59a97bfa66e96100197a31a9760bf7c365176cab23c71ceb92a31211870cdd68fb5c8c4f3d7114f36b0ef66691a3da1b76f6da0295195b7c7317417c864f89812dd466984b667dab6d8774d5813b9552f73a6924e0fcf2c88e645e6d21a40b76e44688da5382defb6aa38be48c9b20617c54da892dfe5e1f2b23c70b2a16c9f5e6af3ed8fa5f9cefe02774d4a191ca3a441b63768b14924f19bfdd82ba857e184bcf279cdf89726d1866ae0163064a4dd96128f212cc3f3f5261b291e5518634423f3a8a221eb44a4bf7ee214a4c2df4d6d412c1e7a2035b31078b36a97d7cbbc438b7f811811c119a986f99aaeb793dab933cbd2bba0f0dacb784d4b58d8a5d9958481ae9d12053bf5446e18a00ad9c8dae4154665825c5fe4729adef3c3caa67454adb2fd2eb0b05e7e7fdfd6e24cb02597d38f6ecb202a163d703d2208f2a78c793000232345da2645949d0563e058724505a406570c4c02b1a699258ce82dbfe1a6e28d58b102f4641d1a8ca0329f123c8011b21f66352c2ea0983938b16deab502fafb2a18153d6e0cb6e5fff897379ee57b8e8fd8a3821a736bf55068e40d64726147c232398da7ada47c37b58ef77c22fac2a41bfe4b54a452dd229feb4b9965fa6c907c3dd4fec744bea7576cd5f03a0c45bd6064c8b210664bfcf9a20296d5f92e7366463c622f4d619b4f6f2e60cded8a07fbaf0aba98a7e80fbd1f87acfd68c14615eb3f4ba5c222f05e32b6009f41fac906941ac548ccf498a2fa180a22a2abee38611017309e891f2e3fc29032aa8ae06370f9dc42b5dabadef7a0a7618e60edfa576a03944c3ae8128816d55d606920eeabecda5532293923377ae23031ad5adaa5e8689ec5c306b2b10a1030dd5ba8c34800692ba6b7623d3e914677eee41d9b58e34b37ecc347151c376662e331d05e5be4f6884b9a90708eba4cbb0873929389391bb8d322093dd2acb7d902f5af09484db752137fc64d02f8fb3040a91d103372e5249863f3c32cfc880dac7b1bf3665b4b43866dddf9719e88bb24246cfd29c4f1a8369f610f2931e3397045d2a09263a4ea5451f54d9f8244fc278e282f73417e810ddabbd80f49c09694896fff46cd6a2ea8425ff71fe4302286b0f6d5463456db03e2a0ff4547649e02d302265db52db8ea3273bd20281cf611d83e56dcca6f93c4b588398bacd43e8ad629244bcc59ec5ad9f68dc92be058232363f805e2d0c22a3d6c7651866e1622d3ee9f956f40615ada24afa2c4f34f1bae60a71bc4fac177604ad1a7f6df45bf179bd2ab956bf15ed36c3b8a36565d5fd1b9f9c5b3d56a91eba02a80a70665f98395e5bc87059a1ce46be2f31bb1e909d5119f607e60500a62a23e3510beae53825030a0726ae5b55137e52d97d5899b27f6e0ba5d4541a6a2d07f5d3480f4ebcd820fd3d7e428dcfda83cf63bfafd5bc5a8ba7767de250cb377b118a7ac2532074219e98206525e7bcd93b0ba78a68acc435685b5dfba3523d364a5d80a7fba8772381a0b0302f88a67a9407c8093f44e826294f5eecc20033acb18a146fbf785f3768cda9490328866e72b8d98d259356cbf3f3674abea57a485b81f9595d4035114c65788d4916f7ec2006a0c2d4318eb5b02b69ae6f416683a00488ad25ce3dfa03098e4ab335a1e75eda977dcf6b06cc54e6fd3d8ba268377342a5ae72c22363fc0f2e660df8b7bc2a72b5a00ad21df6611189149a56ffc24544dbb306cbb211fcd5b928ed069caefe30cb4a9cea3e58c9abf1942c6081726151877ec3f24596ea11a8718e7db672d9b36f32036adee0f1ffddba4724920761efafa78f4148eaf9d94eb17fb158f2cc256111db9a4d46e010ff336ac92fce105a9ba975353567441f03bdba7e4ed6dc972c0457cda9b5cd0be6366f30475a657ea3468f55c3706a44d823f469af48fad7431e217b676423b35ef36b5a52c433856a3c1530eb5fa5f2959cc9ff488fea1993c64fb5f1ebfba260e690e07cf44ca2dd9d708aa35a45550825196728dda4f46b0956ef1dd75afffca20c910abc89c711d8e9d7db48752f7cf621c3d1ccc74eea1d12628396a7a4c8007642597d4f7a5f0f3a7dd36de1637e4076baf375cf1e20fc4a7bd521b0540dd8348fffdf0178ba8cd868e3eac8e63e1712be5740c611e4630a77f3a88a475fc22d422a27e10070dbf3827f04dfbc267378f01322d61bce4527502f055e1f09df932bf0be74e7f2938761f838af96e26ac88eb36bf4996189720b10302d96353c25f1d4aac71401c1c99300169dd70d4a565d1c1f864c3aa3b663f5eeed7dce9a1e460d461d3da0a51e55eb41b9d40d36a9b2d54c21634cb67c6b7d41ba6a14ecd060730569b28ba3064b0133898927e52f7ea3136a391680f6771790ce54789a3ddf06a630539571b827ee72c0c0b9a7c8c53dd19f46c6ff1fcfaba2e553bf37d2ea7002f21bd14904cb08245f8a9a92c352bd6bc4f92e1163f68c528642792a665eeca8f6e58a9689d6aa527da02fda03ed7b4f2fa5e294cb3185715c7a5122a044c80d43879b290ebe91bb283be0587159facd032af0ae582c90c03d7a4a245eeea0bf2fd17cff9fad98a6107e06d4bc4267826132480bff1ca80f73c5c40d0174f531a89d42b04d32b40faf81d3ceb2bb25643e1fd511881d0e345dfe3261b5976d2c921fd895be842ec7f96e0453e0753527f988d467e486c045c6374374716925cc1194ee90a6ae3552be01a16a6da304797ba444ebf53193211af630a85d7b5f5ff5a77574fb6835c7f54a96ebb203136c621342a5674d06a08cbd9c98558c67f06531f5c2907f1869ddaccd74a996601f2dce2259949574eea5fdb333bf238aefc0c9e0db65d9fe5b8cd0e26fef7a1d2d1ce9742276f5d90f656c24fe59ada3e8523e83a643e982e9a17517cb9ad2b6599fcd456c5036573547c1a0b4a339dc96027668ea894704202c80d093b7f374f81ee91104ab8dda4a492b6802ec9fb91c2c4f309d518064cd9c07ed343e8a3d0fbc273e02d389c11ff4f64cf2f469230ba9521803476b11fde0ec4ca582beaec563caf8c6f4c62a299e887d2bf07b413db5f08ef258b3c765b8c5f207cb9f6ab947f4a2f5d2d2e95893fd2985862b6af1fa5c789af18dfef897f15ca5d8ceb43cd46feb000faf74a76fe089ade61b539f15c535c0569c858bf51d03f4891df4e98e96bb301ec84bcccf3d08249cefe19b7d740929853f2b5d133b6882623475001e663bbb156283ced5b73cdc4662f363d89b1464e0bd3a1d88b38ee36a162a4fd219eb2bcf28fd7c5b70a4c5e31b16fec4dcec191e551b16fc406c1f62f454341f53db94d7271a93608767c80ca14afc7b2622ec72bc454d351d50a42858b73b45a6a71096a5984023444c2dd3c348f277bbc17b8e04ee163f61f03e21842bbda603272d4a16f70cf314769002689c72d5bc9208016ba66fe09925bef913cded87424a62eb52fd79964187156d639685ae6d3537e7a347357dcb1dd37434ad53f3e4b534523511de2fb24214eb1fd8c48bce49423b0c1be94ee6ff36d44ab587e949871860ffce77203cbc8bd4696ccde900dc0c78b7dfdb66fa6e1b787ca55c4828b1fdf4fa043592fe7c332d1f88ec7d8379b2e397c7aab06de59efb3f55f7bffb1914e9589a2793806f7f656010f8a2d1500aef08e0cb0b9093a053b94c59e5cd3d584009a74dc774e7ec36870ba94a9aabb1aaff059ef83818bf6391b562c8dea05d412aef431849a8f5cc8a98ee21d759001e959b2130c7196e12918f0acff813147c5fc5117dc9a20de66699731ce46d7448104257e27ddfe52173626f1af55c60c4e4aaf6a91739a4b67a2435c59934dd0b8d00362bdd926ba7864eb55a24ba5d00c403ea91f9cb89500650baf17a8a37d270f8369b02e1bb8d1fd9cfc9bd9573215c3d432005b0cb5d303485c3355bd8bb9b7942120bc9c7e7af9791118867d84083d1328f0c7cbd0c683217ef9e3dbb6c31c2b3027c96e277cb8961c90490f46cccd62d8ab064c5131abe7e12f932f69306c47bc89009fc0f603fd159e71ad1ed9675581b97ac15871a6fba69efaccb3414eaa7502cb446dd7cb42dda3abc270f9ba9e4c92be353c109b9fefb2651a503b63a119999baa68eadbae246d478dc6f244974c477b24192907b57267d9240eff06b1d500863978f405522de056ef9eddef44b30606525b1a0b31670a7e470b4729895375d52d3d7949cbf1e872b655b8d5711357fe23faa8d2075b2192c162637445803c84610d13f3de16ecdecdced9a7417441f5b609a4d6cedbf9a840b85bb1fecbcfca482ea16233ed6d8a55cf645f58c523b24a6614e3b54c5c16289f3b43fe697d0af4aa4a78d193c272254c648fbf09d3340185b046d5e93e0a1153a34fc7aa0bd7b2bc6f30848c46005cf448440ce2a4b79c53442bc99e29dee97fa39746b0953ed1fff4cc12b8a0260ea50ed157eab6a62fcfbf8538cbec74fb20e1c514df815ec9ff8a9dd91c554c7739507753733293d0b20a567123c979709dc1fca3253c7d961a88d972aced558ca1da98075ff737a12374a64db2e66771e3aac99cf323674174783f4b5864b7c00d67037d51fcbaf5bfb0019b6fad04b34000000002ddb5a07ae11f4d7d5fc02c2eebb520db64ab1c4b854bee6522df16d15fb834d4bfeeaee03c78cc26920e31bf8535f970b77d5e22de269810f3b37b0bd25b38 svchost.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "00188006B9806431" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4244 wrote to memory of 4068 4244 rundll32.exe rundll32.exe PID 4244 wrote to memory of 4068 4244 rundll32.exe rundll32.exe PID 4244 wrote to memory of 4068 4244 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\893f1615c8e7470900225101a56bd29e4e5b8047f1fc707d51a13dfe9629b32e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\893f1615c8e7470900225101a56bd29e4e5b8047f1fc707d51a13dfe9629b32e.dll,#12⤵PID:4068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 6283⤵
- Program crash
PID:3676
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
- Modifies data under HKEY_USERS
PID:4044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4068 -ip 40681⤵PID:1932