Static task
static1
Behavioral task
behavioral1
Sample
920-54-0x0000000180000000-0x0000000180005000-memory.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
920-54-0x0000000180000000-0x0000000180005000-memory.dll
Resource
win10v2004-20220414-en
General
-
Target
920-54-0x0000000180000000-0x0000000180005000-memory.dmp
-
Size
20KB
-
MD5
c26844cb7559295efdb244c1952510ff
-
SHA1
085721a84c537c6693ff195d6420291dd24978a3
-
SHA256
349d2b86cfae11e5d63d6a05d8c9d62713068df5f5f5ddff754bb32079425c90
-
SHA512
6ebbfbd76985a5bfa2f9cdbb8f262ad523862b026e6fc8394ae50506fbb5d5d357344831f1e6870aeb70ed318e4efd2180a7ce6fac2585d0b0fd062280a17c42
-
SSDEEP
96:CAVCUOemFbOCsnsLoBTp9PtsRaAyDI6QpWNh1omr:CApOjr4sLETn1wy0nIq
Malware Config
Extracted
icedid
2406015698
commamimubebe.site
asredetyr.site
aszepolityu.fun
likoportio.fun
-
auth_var
6
-
url_path
/news/
Signatures
-
Icedid family
Files
-
920-54-0x0000000180000000-0x0000000180005000-memory.dmp.dll windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 884B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 108B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ