Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
23-05-2022 18:59
Static task
static1
Behavioral task
behavioral1
Sample
0195d25035f1b6742e30deea74e60dc5bc97bd0c1b8ee0cc851afc279ae46002.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
0195d25035f1b6742e30deea74e60dc5bc97bd0c1b8ee0cc851afc279ae46002.exe
-
Size
336KB
-
MD5
c4dc3b3625286c747351914db949dfbf
-
SHA1
d8bfee2a9c3c515a1e8d6498d373b068e2f6625a
-
SHA256
0195d25035f1b6742e30deea74e60dc5bc97bd0c1b8ee0cc851afc279ae46002
-
SHA512
af8d7345fb208574bf08b9bbc01541a61d0d4130edee7cc32a9d01109d837368018e9d0e68d1a8a670736fdcd150fc5680fede116256b2a5447909ef85a1090d
Malware Config
Extracted
Family
icedid
Botnet
513366864
C2
gfthwards.com
gfthwards.eu
gfthwards.net
presifered.com
coujtried.com
Attributes
-
auth_var
10
-
url_path
/index.php
Signatures
-
IcedID Second Stage Loader 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4372-145-0x00000000022E0000-0x00000000022E5000-memory.dmp IcedidSecondLoader -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
0195d25035f1b6742e30deea74e60dc5bc97bd0c1b8ee0cc851afc279ae46002.exepid process 4372 0195d25035f1b6742e30deea74e60dc5bc97bd0c1b8ee0cc851afc279ae46002.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4372-142-0x00000000022C0000-0x00000000022C7000-memory.dmpFilesize
28KB
-
memory/4372-145-0x00000000022E0000-0x00000000022E5000-memory.dmpFilesize
20KB
-
memory/4372-144-0x00000000022C0000-0x00000000022C7000-memory.dmpFilesize
28KB
-
memory/4372-143-0x00000000022C0000-0x00000000022C7000-memory.dmpFilesize
28KB
-
memory/4372-141-0x00000000022C0000-0x00000000022C7000-memory.dmpFilesize
28KB
-
memory/4372-140-0x00000000022C0000-0x00000000022C7000-memory.dmpFilesize
28KB
-
memory/4372-139-0x00000000022C0000-0x00000000022C7000-memory.dmpFilesize
28KB
-
memory/4372-138-0x00000000022C0000-0x00000000022C7000-memory.dmpFilesize
28KB
-
memory/4372-149-0x00000000022C0000-0x00000000022C7000-memory.dmpFilesize
28KB
-
memory/4372-137-0x00000000022C0000-0x00000000022C7000-memory.dmpFilesize
28KB
-
memory/4372-136-0x00000000022C0000-0x00000000022C7000-memory.dmpFilesize
28KB
-
memory/4372-135-0x00000000022C0000-0x00000000022C7000-memory.dmpFilesize
28KB
-
memory/4372-134-0x00000000022C0000-0x00000000022C7000-memory.dmpFilesize
28KB
-
memory/4372-133-0x00000000022C0000-0x00000000022C7000-memory.dmpFilesize
28KB
-
memory/4372-132-0x00000000022C0000-0x00000000022C7000-memory.dmpFilesize
28KB