Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
18-04-2022 13:31
Static task
static1
Behavioral task
behavioral1
Sample
6020cfd6006c9c2bca8593c573eeae83c05106bdf5da3ee8b99bff8eb41ccc73.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
6020cfd6006c9c2bca8593c573eeae83c05106bdf5da3ee8b99bff8eb41ccc73.dll
Resource
win10v2004-20220310-en
General
-
Target
6020cfd6006c9c2bca8593c573eeae83c05106bdf5da3ee8b99bff8eb41ccc73.dll
-
Size
292KB
-
MD5
cfd6ce351f28984ee9a63b1c6269216b
-
SHA1
b73185f2f7efe6666c69d306b9669bb14aceceb2
-
SHA256
6020cfd6006c9c2bca8593c573eeae83c05106bdf5da3ee8b99bff8eb41ccc73
-
SHA512
180e77d3b6f6015c01017133ea0af06c5d9a074c629d1e02a6b92144d5a0894a018c0559bfbcac1b44d2922708c4d7544fc5b5aefce22a1552a32b2a97c2e380
Malware Config
Extracted
icedid
pashamasha.top
pohindra.online
Signatures
-
IcedID Second Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1884-56-0x0000000074EC0000-0x0000000074EC6000-memory.dmp IcedidSecondLoader behavioral1/memory/1884-57-0x0000000074EC0000-0x0000000074F14000-memory.dmp IcedidSecondLoader -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1708 wrote to memory of 1884 1708 rundll32.exe rundll32.exe PID 1708 wrote to memory of 1884 1708 rundll32.exe rundll32.exe PID 1708 wrote to memory of 1884 1708 rundll32.exe rundll32.exe PID 1708 wrote to memory of 1884 1708 rundll32.exe rundll32.exe PID 1708 wrote to memory of 1884 1708 rundll32.exe rundll32.exe PID 1708 wrote to memory of 1884 1708 rundll32.exe rundll32.exe PID 1708 wrote to memory of 1884 1708 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6020cfd6006c9c2bca8593c573eeae83c05106bdf5da3ee8b99bff8eb41ccc73.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6020cfd6006c9c2bca8593c573eeae83c05106bdf5da3ee8b99bff8eb41ccc73.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1884-54-0x0000000000000000-mapping.dmp
-
memory/1884-55-0x00000000758D1000-0x00000000758D3000-memory.dmpFilesize
8KB
-
memory/1884-56-0x0000000074EC0000-0x0000000074EC6000-memory.dmpFilesize
24KB
-
memory/1884-57-0x0000000074EC0000-0x0000000074F14000-memory.dmpFilesize
336KB