Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
09/07/2022, 06:45
Static task
static1
Behavioral task
behavioral1
Sample
6d7e61634926c470b1c0c4d82e56c339.dll
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
6d7e61634926c470b1c0c4d82e56c339.dll
-
Size
534KB
-
MD5
6d7e61634926c470b1c0c4d82e56c339
-
SHA1
e94db816e2c9174b6092b6b5d22182c0f715dee9
-
SHA256
4db1e80508701812751119033e7be5c91c06cb0e41e5d0060799ca7b5f5aad91
-
SHA512
6c5f3a042e4e5c9a032c4a0028e9310f46a48ffd1dd5447b4edd364fb86c20c374b6479c2355eff85feef330c70684f2b46850c958d6eecf074df3136924a5f6
Malware Config
Extracted
Family
icedid
Campaign
227378761
C2
blionarywesta.com
Signatures
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 1092 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1092 rundll32.exe 1092 rundll32.exe