Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
17-04-2022 07:05
Static task
static1
Behavioral task
behavioral1
Sample
280e6951e877b078877f203f95d746e901bb05a8da57a6402f98859d72069693.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
280e6951e877b078877f203f95d746e901bb05a8da57a6402f98859d72069693.dll
-
Size
185KB
-
MD5
6aab62cb31a02543cf3a1be0fa25c8c8
-
SHA1
63b07c2d67b6c8f67499b8c5554949a9a8cce703
-
SHA256
280e6951e877b078877f203f95d746e901bb05a8da57a6402f98859d72069693
-
SHA512
f1a4363775bd02aafd8ac75a88678c55e3687000c3a23ea726ee6632f0672d4b301b6d2ee1db7256dedfd8364fffdb24ad7cf6bbd36f6888db2a52c879e32358
Malware Config
Extracted
Family
icedid
C2
june85.cyou
golddisco.top
Signatures
-
IcedID Second Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral1/memory/884-56-0x0000000074730000-0x0000000074736000-memory.dmp IcedidSecondLoader behavioral1/memory/884-57-0x0000000074730000-0x000000007476E000-memory.dmp IcedidSecondLoader -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1936 wrote to memory of 884 1936 rundll32.exe rundll32.exe PID 1936 wrote to memory of 884 1936 rundll32.exe rundll32.exe PID 1936 wrote to memory of 884 1936 rundll32.exe rundll32.exe PID 1936 wrote to memory of 884 1936 rundll32.exe rundll32.exe PID 1936 wrote to memory of 884 1936 rundll32.exe rundll32.exe PID 1936 wrote to memory of 884 1936 rundll32.exe rundll32.exe PID 1936 wrote to memory of 884 1936 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\280e6951e877b078877f203f95d746e901bb05a8da57a6402f98859d72069693.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\280e6951e877b078877f203f95d746e901bb05a8da57a6402f98859d72069693.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/884-54-0x0000000000000000-mapping.dmp
-
memory/884-55-0x0000000075D21000-0x0000000075D23000-memory.dmpFilesize
8KB
-
memory/884-56-0x0000000074730000-0x0000000074736000-memory.dmpFilesize
24KB
-
memory/884-57-0x0000000074730000-0x000000007476E000-memory.dmpFilesize
248KB