Analysis
-
max time kernel
146s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-05-2022 12:28
Static task
static1
Behavioral task
behavioral1
Sample
fa79f39d2512326f3645ec051f32c4b0f175142bc5f43e0b869bdcfe32d18ca4.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
fa79f39d2512326f3645ec051f32c4b0f175142bc5f43e0b869bdcfe32d18ca4.exe
Resource
win10v2004-20220414-en
General
-
Target
fa79f39d2512326f3645ec051f32c4b0f175142bc5f43e0b869bdcfe32d18ca4.exe
-
Size
228KB
-
MD5
0e582f1d214712c263429692549010ef
-
SHA1
50c8cbdaa3b781d00e6e8df336af7620fcb90136
-
SHA256
fa79f39d2512326f3645ec051f32c4b0f175142bc5f43e0b869bdcfe32d18ca4
-
SHA512
7eac85ab9f8e9ff4d7602569d363293639b997e609694ade84e8211aa9dddeec67984281f0775da6970d41e0ed9e13d6d845afaf14a3dbd1287b819d56c010ff
Malware Config
Extracted
icedid
Extracted
icedid
3940132575
besitxavier.best
nazifestivo.best
-
auth_var
2
-
url_path
/audio/
Signatures
-
IcedID Second Stage Loader 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2040-55-0x0000000000370000-0x0000000000378000-memory.dmp IcedidSecondLoader behavioral1/memory/2040-59-0x0000000000380000-0x0000000000386000-memory.dmp IcedidSecondLoader behavioral1/memory/2040-63-0x0000000000360000-0x0000000000365000-memory.dmp IcedidSecondLoader -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
fa79f39d2512326f3645ec051f32c4b0f175142bc5f43e0b869bdcfe32d18ca4.exepid process 2040 fa79f39d2512326f3645ec051f32c4b0f175142bc5f43e0b869bdcfe32d18ca4.exe 2040 fa79f39d2512326f3645ec051f32c4b0f175142bc5f43e0b869bdcfe32d18ca4.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2040-54-0x0000000076261000-0x0000000076263000-memory.dmpFilesize
8KB
-
memory/2040-55-0x0000000000370000-0x0000000000378000-memory.dmpFilesize
32KB
-
memory/2040-59-0x0000000000380000-0x0000000000386000-memory.dmpFilesize
24KB
-
memory/2040-63-0x0000000000360000-0x0000000000365000-memory.dmpFilesize
20KB