Analysis
-
max time kernel
144s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 23:30
Static task
static1
Behavioral task
behavioral1
Sample
9574cc4740c03374c0fedea7f6799b1adc97cd52d072514ad8d2bb9f35c30b7d.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
9574cc4740c03374c0fedea7f6799b1adc97cd52d072514ad8d2bb9f35c30b7d.dll
-
Size
224KB
-
MD5
bb88a9438617cedd24f610e306e8649f
-
SHA1
6f97f95e803caa92f8ef91c27927b299c3c1c54b
-
SHA256
9574cc4740c03374c0fedea7f6799b1adc97cd52d072514ad8d2bb9f35c30b7d
-
SHA512
046810911496c2fc84d71de62ae4436110ed3ed48404790febddffe417c6563a95768d22218110eb4954f9f67becd52b3b614d7b1ebecdf2b6f83f203fdb919e
Malware Config
Extracted
Family
icedid
C2
loadberlin.casa
Signatures
-
IcedID First Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3124-131-0x0000000075550000-0x0000000075594000-memory.dmp IcedidFirstLoader behavioral2/memory/3124-132-0x0000000075550000-0x0000000075556000-memory.dmp IcedidFirstLoader -
Blocklisted process makes network request 9 IoCs
Processes:
rundll32.exeflow pid process 27 3124 rundll32.exe 28 3124 rundll32.exe 33 3124 rundll32.exe 35 3124 rundll32.exe 37 3124 rundll32.exe 39 3124 rundll32.exe 41 3124 rundll32.exe 43 3124 rundll32.exe 45 3124 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1820 wrote to memory of 3124 1820 rundll32.exe rundll32.exe PID 1820 wrote to memory of 3124 1820 rundll32.exe rundll32.exe PID 1820 wrote to memory of 3124 1820 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9574cc4740c03374c0fedea7f6799b1adc97cd52d072514ad8d2bb9f35c30b7d.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9574cc4740c03374c0fedea7f6799b1adc97cd52d072514ad8d2bb9f35c30b7d.dll,#12⤵
- Blocklisted process makes network request