Analysis
-
max time kernel
162s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
18-04-2022 13:32
Static task
static1
Behavioral task
behavioral1
Sample
e68bc022556603e8935cda493ce2b5c5fdf91b0ebfa45b2fb0c6b03842c50a55.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
e68bc022556603e8935cda493ce2b5c5fdf91b0ebfa45b2fb0c6b03842c50a55.dll
-
Size
242KB
-
MD5
7b07db7c5b61c1a6195d1797d9d6a495
-
SHA1
796131744a7eef358f836a17cf668ea984480433
-
SHA256
e68bc022556603e8935cda493ce2b5c5fdf91b0ebfa45b2fb0c6b03842c50a55
-
SHA512
c9fb00512df6913f45a291d73e7885c7aea19431dadc9d87f42e6c6a98f3ae9a0b0abcbd5b66ddbe5e3fa810f9351bc167cfb28ad2bd950d8f77b6f25e6b4953
Malware Config
Extracted
Family
icedid
C2
goblinsdown.top
daysarecommitee.top
Signatures
-
IcedID Second Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4112-131-0x0000000075520000-0x0000000075526000-memory.dmp IcedidSecondLoader behavioral2/memory/4112-132-0x0000000075520000-0x000000007556F000-memory.dmp IcedidSecondLoader -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4044 wrote to memory of 4112 4044 regsvr32.exe regsvr32.exe PID 4044 wrote to memory of 4112 4044 regsvr32.exe regsvr32.exe PID 4044 wrote to memory of 4112 4044 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e68bc022556603e8935cda493ce2b5c5fdf91b0ebfa45b2fb0c6b03842c50a55.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e68bc022556603e8935cda493ce2b5c5fdf91b0ebfa45b2fb0c6b03842c50a55.dll2⤵