Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-04-2022 09:42
Static task
static1
Behavioral task
behavioral1
Sample
f277d223bdc994b386e3f267cb1512ca0520471a2525a99a839854a085d067f1.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
f277d223bdc994b386e3f267cb1512ca0520471a2525a99a839854a085d067f1.dll
-
Size
179KB
-
MD5
e66d56a3d670a47202ae9f3d4008b5e1
-
SHA1
826faa17d91a6bdb649f562251bab51d7aba45df
-
SHA256
f277d223bdc994b386e3f267cb1512ca0520471a2525a99a839854a085d067f1
-
SHA512
e356cdb25c639adc5711dea2587bab46fc633bcb256e6f63daab3c069ca5c11d83b53b53c0db98dbe3df65ffd396ddcaca86fd77a183ecaca21a966bf01892c1
Malware Config
Extracted
Family
icedid
C2
balkimraklire.cyou
angarakolessi.top
Signatures
-
IcedID Second Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1964-131-0x0000000074BF0000-0x0000000074C2C000-memory.dmp IcedidSecondLoader behavioral2/memory/1964-132-0x0000000074BF0000-0x0000000074BF6000-memory.dmp IcedidSecondLoader -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2428 wrote to memory of 1964 2428 regsvr32.exe regsvr32.exe PID 2428 wrote to memory of 1964 2428 regsvr32.exe regsvr32.exe PID 2428 wrote to memory of 1964 2428 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f277d223bdc994b386e3f267cb1512ca0520471a2525a99a839854a085d067f1.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\f277d223bdc994b386e3f267cb1512ca0520471a2525a99a839854a085d067f1.dll2⤵