Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
17-04-2022 23:44
Static task
static1
Behavioral task
behavioral1
Sample
3c5af2d1412d47be0eda681eebf808155a37f4911f2f2925c4adc5c5824dea98.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
3c5af2d1412d47be0eda681eebf808155a37f4911f2f2925c4adc5c5824dea98.dll
-
Size
390KB
-
MD5
9fd438c6e278d0349bf5ffd82fcf27ef
-
SHA1
6ea3a0609cbbd6237e80d1513303f379e9704745
-
SHA256
3c5af2d1412d47be0eda681eebf808155a37f4911f2f2925c4adc5c5824dea98
-
SHA512
ae22e778c629b28ca37e5bb42a3e0bcfd89030bac8562d915cf2590926c48531c29a3225ff05caf86fd64e2db25886571df1744c5cc6abf867f83581633985d0
Malware Config
Extracted
Family
icedid
C2
isolatedglobus.top
Signatures
-
IcedID First Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1604-131-0x0000000074BE0000-0x0000000074BE6000-memory.dmp IcedidFirstLoader behavioral2/memory/1604-132-0x0000000074BE0000-0x0000000074C51000-memory.dmp IcedidFirstLoader -
Blocklisted process makes network request 11 IoCs
Processes:
rundll32.exeflow pid process 11 1604 rundll32.exe 13 1604 rundll32.exe 15 1604 rundll32.exe 17 1604 rundll32.exe 19 1604 rundll32.exe 21 1604 rundll32.exe 23 1604 rundll32.exe 25 1604 rundll32.exe 27 1604 rundll32.exe 30 1604 rundll32.exe 32 1604 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4248 wrote to memory of 1604 4248 rundll32.exe rundll32.exe PID 4248 wrote to memory of 1604 4248 rundll32.exe rundll32.exe PID 4248 wrote to memory of 1604 4248 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3c5af2d1412d47be0eda681eebf808155a37f4911f2f2925c4adc5c5824dea98.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3c5af2d1412d47be0eda681eebf808155a37f4911f2f2925c4adc5c5824dea98.dll,#12⤵
- Blocklisted process makes network request