Analysis
-
max time kernel
61s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220331-en -
submitted
30-03-2022 00:18
Static task
static1
Behavioral task
behavioral1
Sample
d05eb3374be903acfa2b66521b12e5883491285d6639c21af5940c041030ff9c.dll
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
General
-
Target
d05eb3374be903acfa2b66521b12e5883491285d6639c21af5940c041030ff9c.dll
-
Size
346KB
-
MD5
0195726f9576d8eddb87a16eb4f8e8db
-
SHA1
be48f8e713678473abe16b86f7f505b96461f266
-
SHA256
d05eb3374be903acfa2b66521b12e5883491285d6639c21af5940c041030ff9c
-
SHA512
a44eb3efbe996aca445e0b491e26585b5b9eced4227279466dd4568e60f6e35b95b718d46aac3d5d88cf9d84cfcc15b275f079192b45d33929e35813d1394064
Malware Config
Extracted
Family
icedid
Signatures
-
IcedID First Stage Loader 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2708-125-0x0000000075630000-0x0000000075636000-memory.dmp IcedidFirstLoader -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2224 wrote to memory of 2708 2224 regsvr32.exe regsvr32.exe PID 2224 wrote to memory of 2708 2224 regsvr32.exe regsvr32.exe PID 2224 wrote to memory of 2708 2224 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\d05eb3374be903acfa2b66521b12e5883491285d6639c21af5940c041030ff9c.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\d05eb3374be903acfa2b66521b12e5883491285d6639c21af5940c041030ff9c.dll2⤵