Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
17-04-2022 07:05
Static task
static1
Behavioral task
behavioral1
Sample
6b9dea0ee12016eb5575f80c6e146c7cc3daebfedb45d8ddbbd84f639ec83855.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
6b9dea0ee12016eb5575f80c6e146c7cc3daebfedb45d8ddbbd84f639ec83855.dll
-
Size
275KB
-
MD5
65170474a68cb34c8f2f2e1509ef95cd
-
SHA1
7884fb513decf5a218a7103e4a89ff70195b7a81
-
SHA256
6b9dea0ee12016eb5575f80c6e146c7cc3daebfedb45d8ddbbd84f639ec83855
-
SHA512
e217e0ed697136e8b1fd5f07747c24303d8bd511938e69aebdd5383471fad3a03fe7a0ca9cdafe4855088221418263a02a2dedf3ab1b931ff619079fb1b5623c
Malware Config
Extracted
Family
icedid
C2
balkimraklire.cyou
angarakolessi.top
Signatures
-
IcedID Second Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1908-56-0x0000000074B30000-0x0000000074B36000-memory.dmp IcedidSecondLoader behavioral1/memory/1908-57-0x0000000074B30000-0x0000000074B82000-memory.dmp IcedidSecondLoader -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1260 wrote to memory of 1908 1260 rundll32.exe rundll32.exe PID 1260 wrote to memory of 1908 1260 rundll32.exe rundll32.exe PID 1260 wrote to memory of 1908 1260 rundll32.exe rundll32.exe PID 1260 wrote to memory of 1908 1260 rundll32.exe rundll32.exe PID 1260 wrote to memory of 1908 1260 rundll32.exe rundll32.exe PID 1260 wrote to memory of 1908 1260 rundll32.exe rundll32.exe PID 1260 wrote to memory of 1908 1260 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6b9dea0ee12016eb5575f80c6e146c7cc3daebfedb45d8ddbbd84f639ec83855.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6b9dea0ee12016eb5575f80c6e146c7cc3daebfedb45d8ddbbd84f639ec83855.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1908-54-0x0000000000000000-mapping.dmp
-
memory/1908-55-0x0000000075CE1000-0x0000000075CE3000-memory.dmpFilesize
8KB
-
memory/1908-56-0x0000000074B30000-0x0000000074B36000-memory.dmpFilesize
24KB
-
memory/1908-57-0x0000000074B30000-0x0000000074B82000-memory.dmpFilesize
328KB