Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-04-2022 09:42
Static task
static1
Behavioral task
behavioral1
Sample
a807b336b35997f55cf967d40e42d0b9112a09293a92b3b344859cf40541cc60.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
a807b336b35997f55cf967d40e42d0b9112a09293a92b3b344859cf40541cc60.dll
-
Size
185KB
-
MD5
6fec1905fbc51997dbc335fe5a9d1ac7
-
SHA1
d057669cdadecf5d44ef23bc7301dad0a48d73fe
-
SHA256
a807b336b35997f55cf967d40e42d0b9112a09293a92b3b344859cf40541cc60
-
SHA512
5b0a1d6af25b6a7bdf7a43dfb1b9af19c8f7e7deafa8209a2dc2e491484e3823f60bdb66225ae1e6da0d0f266e324273d75f73c29bc0d6221242ceeddcbe0bcd
Malware Config
Extracted
Family
icedid
C2
june85.cyou
golddisco.top
Signatures
-
IcedID Second Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2844-131-0x0000000074F10000-0x0000000074F16000-memory.dmp IcedidSecondLoader behavioral2/memory/2844-132-0x0000000074F10000-0x0000000074F4E000-memory.dmp IcedidSecondLoader -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1732 wrote to memory of 2844 1732 rundll32.exe rundll32.exe PID 1732 wrote to memory of 2844 1732 rundll32.exe rundll32.exe PID 1732 wrote to memory of 2844 1732 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a807b336b35997f55cf967d40e42d0b9112a09293a92b3b344859cf40541cc60.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a807b336b35997f55cf967d40e42d0b9112a09293a92b3b344859cf40541cc60.dll,#12⤵