Analysis
-
max time kernel
146s -
max time network
62s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
17-04-2022 16:31
Static task
static1
Behavioral task
behavioral1
Sample
097ae1f8d38097f78f07e94169bf219ccccb7a1301085119ce9a857e7100ecf4.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
097ae1f8d38097f78f07e94169bf219ccccb7a1301085119ce9a857e7100ecf4.dll
-
Size
250KB
-
MD5
ecc4db77df54bad05af7d7631b07517b
-
SHA1
2a702d7171d49ef9b4395b3c2e1e64eca9850a45
-
SHA256
097ae1f8d38097f78f07e94169bf219ccccb7a1301085119ce9a857e7100ecf4
-
SHA512
a3708f2a4cd1375e06751cf6a4d20fc67377641d13f38065669a51afc2160b11097fa14e46558857f6c2996bf4793fb3d10bc57fcd6663b565a8ff28a024748a
Malware Config
Extracted
Family
icedid
C2
texasfresnos.top
ds349onmo.online
Signatures
-
IcedID Second Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral1/memory/760-56-0x0000000075420000-0x0000000075426000-memory.dmp IcedidSecondLoader behavioral1/memory/760-57-0x0000000075420000-0x0000000075475000-memory.dmp IcedidSecondLoader -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1012 wrote to memory of 760 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 760 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 760 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 760 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 760 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 760 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 760 1012 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\097ae1f8d38097f78f07e94169bf219ccccb7a1301085119ce9a857e7100ecf4.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\097ae1f8d38097f78f07e94169bf219ccccb7a1301085119ce9a857e7100ecf4.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/760-54-0x0000000000000000-mapping.dmp
-
memory/760-55-0x0000000076851000-0x0000000076853000-memory.dmpFilesize
8KB
-
memory/760-56-0x0000000075420000-0x0000000075426000-memory.dmpFilesize
24KB
-
memory/760-57-0x0000000075420000-0x0000000075475000-memory.dmpFilesize
340KB