Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-04-2022 11:57
Static task
static1
Behavioral task
behavioral1
Sample
ebcb71230ee2957d42c96e87027e26d9186091b61f900ccdb1f738ae10ad2d81.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
ebcb71230ee2957d42c96e87027e26d9186091b61f900ccdb1f738ae10ad2d81.dll
-
Size
160KB
-
MD5
df8a2b2a908ec9c91873791d342d5f61
-
SHA1
87d4d15f6cd4311a5bd9bb3d3ed36fbdebe37410
-
SHA256
ebcb71230ee2957d42c96e87027e26d9186091b61f900ccdb1f738ae10ad2d81
-
SHA512
9b6e3787f4f22422b7fe912d1060c401c57133086a8249c8d1e2a7a01dae410be72837a31a70b32bc8dcd296e44493b2421aa455ca47380c4da55cd65990254b
Malware Config
Extracted
Family
icedid
C2
54asplane.top
yorkykukri24.top
Signatures
-
IcedID Second Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral2/memory/892-131-0x0000000075390000-0x0000000075396000-memory.dmp IcedidSecondLoader behavioral2/memory/892-132-0x0000000075390000-0x00000000753C4000-memory.dmp IcedidSecondLoader -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 3440 wrote to memory of 892 3440 regsvr32.exe regsvr32.exe PID 3440 wrote to memory of 892 3440 regsvr32.exe regsvr32.exe PID 3440 wrote to memory of 892 3440 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ebcb71230ee2957d42c96e87027e26d9186091b61f900ccdb1f738ae10ad2d81.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\ebcb71230ee2957d42c96e87027e26d9186091b61f900ccdb1f738ae10ad2d81.dll2⤵