Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
14-04-2022 14:27
Static task
static1
Behavioral task
behavioral1
Sample
d0803a6fd689e0a771c1008a6e0d9ee6093ee7369f485354b27b0eab7d8166e8.dll
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
General
-
Target
d0803a6fd689e0a771c1008a6e0d9ee6093ee7369f485354b27b0eab7d8166e8.dll
-
Size
195KB
-
MD5
141b5d7351136439cf47c73e1d7e7e1f
-
SHA1
ee5a21035a20702d1633f918613cb54440be4679
-
SHA256
d0803a6fd689e0a771c1008a6e0d9ee6093ee7369f485354b27b0eab7d8166e8
-
SHA512
d9179c7e6a95391c55a418ccf8e67108e8e86e0eb959b8b1c232b8dc99978dce58c0db26d682a8ffdce300092ad223ca07f5ea04f1df0d30522096c4bf01668e
Malware Config
Extracted
Family
icedid
C2
colombosuede.club
colosssueded.top
Signatures
-
IcedID Second Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4616-135-0x00000000753B0000-0x00000000753B6000-memory.dmp IcedidSecondLoader behavioral2/memory/4616-136-0x00000000753B0000-0x00000000753F0000-memory.dmp IcedidSecondLoader -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1396 wrote to memory of 4616 1396 regsvr32.exe regsvr32.exe PID 1396 wrote to memory of 4616 1396 regsvr32.exe regsvr32.exe PID 1396 wrote to memory of 4616 1396 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\d0803a6fd689e0a771c1008a6e0d9ee6093ee7369f485354b27b0eab7d8166e8.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\d0803a6fd689e0a771c1008a6e0d9ee6093ee7369f485354b27b0eab7d8166e8.dll2⤵