Analysis
-
max time kernel
4294181s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
26-03-2022 09:27
Static task
static1
Behavioral task
behavioral1
Sample
e3d8e33c28f16e25e4f8f5b047d8bb68e10f789da382dbe5873cd55a3ed1de27.dll
Resource
win7-20220311-en
0 signatures
0 seconds
General
-
Target
e3d8e33c28f16e25e4f8f5b047d8bb68e10f789da382dbe5873cd55a3ed1de27.dll
-
Size
346KB
-
MD5
9d93c2049216ee836046cae8500bd504
-
SHA1
8a4125e842d831477bd4a464bb24b12c726ef612
-
SHA256
e3d8e33c28f16e25e4f8f5b047d8bb68e10f789da382dbe5873cd55a3ed1de27
-
SHA512
1bf6e442f66bb7a4e22f2d02aa81bcfce9ca31da0e3772fcdbc81100f38e69ceeca6e31a5c0635d1239f4b3845192f113ab8c41e9510f03d10a36986639d164c
Malware Config
Extracted
Family
icedid
Signatures
-
IcedID First Stage Loader 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1328-57-0x00000000749D0000-0x00000000749D6000-memory.dmp IcedidFirstLoader -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1280 wrote to memory of 1328 1280 regsvr32.exe regsvr32.exe PID 1280 wrote to memory of 1328 1280 regsvr32.exe regsvr32.exe PID 1280 wrote to memory of 1328 1280 regsvr32.exe regsvr32.exe PID 1280 wrote to memory of 1328 1280 regsvr32.exe regsvr32.exe PID 1280 wrote to memory of 1328 1280 regsvr32.exe regsvr32.exe PID 1280 wrote to memory of 1328 1280 regsvr32.exe regsvr32.exe PID 1280 wrote to memory of 1328 1280 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e3d8e33c28f16e25e4f8f5b047d8bb68e10f789da382dbe5873cd55a3ed1de27.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e3d8e33c28f16e25e4f8f5b047d8bb68e10f789da382dbe5873cd55a3ed1de27.dll2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1280-54-0x000007FEFBE31000-0x000007FEFBE33000-memory.dmpFilesize
8KB
-
memory/1328-55-0x0000000000000000-mapping.dmp
-
memory/1328-56-0x0000000076071000-0x0000000076073000-memory.dmpFilesize
8KB
-
memory/1328-57-0x00000000749D0000-0x00000000749D6000-memory.dmpFilesize
24KB