Analysis
-
max time kernel
4294185s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
30-03-2022 00:33
Static task
static1
Behavioral task
behavioral1
Sample
document.lnk
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
document.lnk
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
minro.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
minro.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
minro.exe
-
Size
124KB
-
MD5
6187867745754121e5b29c16e05e6164
-
SHA1
daeb28c0e2db1dd78caff0d4b9d863d1f8656e47
-
SHA256
617e0f57f4283ca044003326663b5614d66f97e16bccdd8bec1321fad44a7195
-
SHA512
88b04366e121c02bd6f74f1ff5f305a87e91eb97b00ee4dbbe84761e407e26b3af262b84f9f47fc87a7277c334106a93bd7ba75a1a40f3b82b6c0f418adb3d02
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
1666752692
C2
ritionalvalueon.top
Signatures
-
IcedID First Stage Loader 1 IoCs
Processes:
resource yara_rule behavioral3/memory/1040-54-0x0000000140000000-0x000000014000B000-memory.dmp IcedidFirstLoader -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1740 1040 WerFault.exe minro.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
minro.exedescription pid process target process PID 1040 wrote to memory of 1740 1040 minro.exe WerFault.exe PID 1040 wrote to memory of 1740 1040 minro.exe WerFault.exe PID 1040 wrote to memory of 1740 1040 minro.exe WerFault.exe