Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
19-04-2022 03:09
Static task
static1
Behavioral task
behavioral1
Sample
2a27d5511d7d3576e41543570cab5b2e10d3a915320d5224a5986d15b5e8ae00.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2a27d5511d7d3576e41543570cab5b2e10d3a915320d5224a5986d15b5e8ae00.dll
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
2a27d5511d7d3576e41543570cab5b2e10d3a915320d5224a5986d15b5e8ae00.dll
-
Size
88KB
-
MD5
edcbac74f7f1e2b08ed9f8c35314a1c3
-
SHA1
dc18ec9bdda1004aa3d1a1b15dba0542a3031656
-
SHA256
2a27d5511d7d3576e41543570cab5b2e10d3a915320d5224a5986d15b5e8ae00
-
SHA512
04600a9143018115e22b596650b71e9a03966725eaf256572b6c4bc963ba140abb0155d2054f1864b13d9d835a7bdd9256ca90cd05fcd2ec2321a30ec2e073cb
Malware Config
Extracted
Family
icedid
C2
ldrcreep.net
Signatures
-
IcedID First Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1972-56-0x0000000010000000-0x0000000010006000-memory.dmp IcedidFirstLoader behavioral1/memory/1972-57-0x0000000010000000-0x000000001002C000-memory.dmp IcedidFirstLoader -
Blocklisted process makes network request 24 IoCs
Processes:
rundll32.exeflow pid process 3 1972 rundll32.exe 4 1972 rundll32.exe 6 1972 rundll32.exe 7 1972 rundll32.exe 9 1972 rundll32.exe 10 1972 rundll32.exe 12 1972 rundll32.exe 14 1972 rundll32.exe 18 1972 rundll32.exe 19 1972 rundll32.exe 20 1972 rundll32.exe 21 1972 rundll32.exe 23 1972 rundll32.exe 24 1972 rundll32.exe 26 1972 rundll32.exe 27 1972 rundll32.exe 29 1972 rundll32.exe 30 1972 rundll32.exe 31 1972 rundll32.exe 32 1972 rundll32.exe 34 1972 rundll32.exe 35 1972 rundll32.exe 37 1972 rundll32.exe 38 1972 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1892 wrote to memory of 1972 1892 rundll32.exe rundll32.exe PID 1892 wrote to memory of 1972 1892 rundll32.exe rundll32.exe PID 1892 wrote to memory of 1972 1892 rundll32.exe rundll32.exe PID 1892 wrote to memory of 1972 1892 rundll32.exe rundll32.exe PID 1892 wrote to memory of 1972 1892 rundll32.exe rundll32.exe PID 1892 wrote to memory of 1972 1892 rundll32.exe rundll32.exe PID 1892 wrote to memory of 1972 1892 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2a27d5511d7d3576e41543570cab5b2e10d3a915320d5224a5986d15b5e8ae00.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2a27d5511d7d3576e41543570cab5b2e10d3a915320d5224a5986d15b5e8ae00.dll,#12⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1972-54-0x0000000000000000-mapping.dmp
-
memory/1972-55-0x00000000756E1000-0x00000000756E3000-memory.dmpFilesize
8KB
-
memory/1972-56-0x0000000010000000-0x0000000010006000-memory.dmpFilesize
24KB
-
memory/1972-57-0x0000000010000000-0x000000001002C000-memory.dmpFilesize
176KB