Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
17-04-2022 07:05
Static task
static1
Behavioral task
behavioral1
Sample
6b9dea0ee12016eb5575f80c6e146c7cc3daebfedb45d8ddbbd84f639ec83855.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
6b9dea0ee12016eb5575f80c6e146c7cc3daebfedb45d8ddbbd84f639ec83855.dll
-
Size
275KB
-
MD5
65170474a68cb34c8f2f2e1509ef95cd
-
SHA1
7884fb513decf5a218a7103e4a89ff70195b7a81
-
SHA256
6b9dea0ee12016eb5575f80c6e146c7cc3daebfedb45d8ddbbd84f639ec83855
-
SHA512
e217e0ed697136e8b1fd5f07747c24303d8bd511938e69aebdd5383471fad3a03fe7a0ca9cdafe4855088221418263a02a2dedf3ab1b931ff619079fb1b5623c
Malware Config
Extracted
Family
icedid
C2
balkimraklire.cyou
angarakolessi.top
Signatures
-
IcedID Second Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1600-131-0x0000000075720000-0x0000000075726000-memory.dmp IcedidSecondLoader behavioral2/memory/1600-132-0x0000000075720000-0x0000000075772000-memory.dmp IcedidSecondLoader -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2180 wrote to memory of 1600 2180 rundll32.exe rundll32.exe PID 2180 wrote to memory of 1600 2180 rundll32.exe rundll32.exe PID 2180 wrote to memory of 1600 2180 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6b9dea0ee12016eb5575f80c6e146c7cc3daebfedb45d8ddbbd84f639ec83855.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6b9dea0ee12016eb5575f80c6e146c7cc3daebfedb45d8ddbbd84f639ec83855.dll,#12⤵