icedid | 756-54-0x0000000000100000-0x000000000010B000-memory[.]dmp | Triage

Sharing

General

Target

756-54-0x0000000000100000-0x000000000010B000-memory.dmp
Size

44KB
MD5

9ea033040a8b5fee692b189f2fcea60f
SHA1

ccfaaeffbee56cfe2c8e9b717be87e37b9cd266d
SHA256

d73b7af1f21bfc7a968367f97b028194134b188d9ca2a7cdbbeafe7e8ba4127d
SHA512

1c6a2459cb1e9b50de620a1df932a6aa83fc579d8b8e31328363c646247d15bab5cb4e9f503a91322e3dd2f7adb391fad2efa4bedec719c6309d0f01bc7b74e8
SSDEEP

384:aAybRgY6EAL4eIQsn1pM6+OJh5QX+zzanFN/vwLu0:XbIQsn1x+xuKnFNvwy

Score

10^/10

loader 468039940 icedid

Malware Config

Extracted

Family

icedid

Campaign

468039940

C2

arelyevennot.top

Signatures

IcedID First Stage Loader 1 IoCs
loader

Processes:

resource yara_rule

sample IcedidFirstLoader
Icedid family
icedid

Files

756-54-0x0000000000100000-0x000000000010B000-memory.dmp
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.c
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 512B - Virtual size: 6B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.r
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.d
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE