Analysis
-
max time kernel
138s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
30-03-2022 08:56
Static task
static1
Behavioral task
behavioral1
Sample
7a9679793408a36e6c81d9bc35d020b21138f57bbc49edf37e0feabd999e1f5f.dll
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
General
-
Target
7a9679793408a36e6c81d9bc35d020b21138f57bbc49edf37e0feabd999e1f5f.dll
-
Size
346KB
-
MD5
8ac9bfffecc62e98377b6377f15270af
-
SHA1
59e22784f4404bfdb505fbd3e8f52ed67d57f5f6
-
SHA256
7a9679793408a36e6c81d9bc35d020b21138f57bbc49edf37e0feabd999e1f5f
-
SHA512
5b7126afcb85d2b32e2ed374ec2ac4e450b98e487ee7a78dbfefc56d5a0db691510673528d00cfb8d8ff46f4dbd1f6e494db837c40c39ec7993a9fa26048210b
Malware Config
Extracted
Family
icedid
Signatures
-
IcedID First Stage Loader 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1996-131-0x00000000756D0000-0x00000000756D6000-memory.dmp IcedidFirstLoader -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1768 wrote to memory of 1996 1768 regsvr32.exe regsvr32.exe PID 1768 wrote to memory of 1996 1768 regsvr32.exe regsvr32.exe PID 1768 wrote to memory of 1996 1768 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7a9679793408a36e6c81d9bc35d020b21138f57bbc49edf37e0feabd999e1f5f.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\7a9679793408a36e6c81d9bc35d020b21138f57bbc49edf37e0feabd999e1f5f.dll2⤵