Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-05-2022 12:28
Static task
static1
Behavioral task
behavioral1
Sample
fa79f39d2512326f3645ec051f32c4b0f175142bc5f43e0b869bdcfe32d18ca4.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
fa79f39d2512326f3645ec051f32c4b0f175142bc5f43e0b869bdcfe32d18ca4.exe
Resource
win10v2004-20220414-en
General
-
Target
fa79f39d2512326f3645ec051f32c4b0f175142bc5f43e0b869bdcfe32d18ca4.exe
-
Size
228KB
-
MD5
0e582f1d214712c263429692549010ef
-
SHA1
50c8cbdaa3b781d00e6e8df336af7620fcb90136
-
SHA256
fa79f39d2512326f3645ec051f32c4b0f175142bc5f43e0b869bdcfe32d18ca4
-
SHA512
7eac85ab9f8e9ff4d7602569d363293639b997e609694ade84e8211aa9dddeec67984281f0775da6970d41e0ed9e13d6d845afaf14a3dbd1287b819d56c010ff
Malware Config
Extracted
icedid
Extracted
icedid
3940132575
besitxavier.best
nazifestivo.best
-
auth_var
2
-
url_path
/audio/
Signatures
-
IcedID Second Stage Loader 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2040-130-0x0000000002490000-0x0000000002498000-memory.dmp IcedidSecondLoader behavioral2/memory/2040-134-0x00000000024A0000-0x00000000024A6000-memory.dmp IcedidSecondLoader behavioral2/memory/2040-138-0x0000000002480000-0x0000000002485000-memory.dmp IcedidSecondLoader -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
fa79f39d2512326f3645ec051f32c4b0f175142bc5f43e0b869bdcfe32d18ca4.exepid process 2040 fa79f39d2512326f3645ec051f32c4b0f175142bc5f43e0b869bdcfe32d18ca4.exe 2040 fa79f39d2512326f3645ec051f32c4b0f175142bc5f43e0b869bdcfe32d18ca4.exe