Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220331-en -
submitted
14-04-2022 06:55
Static task
static1
Behavioral task
behavioral1
Sample
aff6cde451bf25e6d6b8292e3221618cb5842db61a74f6c23cafbd16cf875849.dll
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
General
-
Target
aff6cde451bf25e6d6b8292e3221618cb5842db61a74f6c23cafbd16cf875849.dll
-
Size
195KB
-
MD5
37f179fb4e176d979ebd8f9bc549fe2f
-
SHA1
4f8868091097895d059db293905925d8fcc199ea
-
SHA256
aff6cde451bf25e6d6b8292e3221618cb5842db61a74f6c23cafbd16cf875849
-
SHA512
100ff183acf53d34bd00a6469a8d4248d7f692fd05fe4724169b395903e85da5fe9fa43ed07c2612156b0ef6ad28249d321cdfccf57dff85872caa3e7284edef
Malware Config
Extracted
Family
icedid
C2
colombosuede.club
colosssueded.top
Signatures
-
IcedID Second Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4876-125-0x0000000074A10000-0x0000000074A16000-memory.dmp IcedidSecondLoader behavioral2/memory/4876-126-0x0000000074A10000-0x0000000074A50000-memory.dmp IcedidSecondLoader -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 388 wrote to memory of 4876 388 regsvr32.exe regsvr32.exe PID 388 wrote to memory of 4876 388 regsvr32.exe regsvr32.exe PID 388 wrote to memory of 4876 388 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\aff6cde451bf25e6d6b8292e3221618cb5842db61a74f6c23cafbd16cf875849.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\aff6cde451bf25e6d6b8292e3221618cb5842db61a74f6c23cafbd16cf875849.dll2⤵