Analysis
-
max time kernel
90s -
max time network
78s -
platform
windows10-2004_x64 -
resource
win10v2004-20220718-en -
resource tags
arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2022, 08:44
Static task
static1
Behavioral task
behavioral1
Sample
67299ce0f6644ec5c4bc807f6cd5683b1755ca61f14ae4df0d34465801541e99.dll
Resource
win10v2004-20220718-en
4 signatures
150 seconds
General
-
Target
67299ce0f6644ec5c4bc807f6cd5683b1755ca61f14ae4df0d34465801541e99.dll
-
Size
102KB
-
MD5
d6530ccbe6ba26ed6370aaa072e4dad0
-
SHA1
16955a712ed799dc8df9e7f4b21272f3760cba39
-
SHA256
67299ce0f6644ec5c4bc807f6cd5683b1755ca61f14ae4df0d34465801541e99
-
SHA512
f8a67d337b4c108eddb1fd5f6a7d399b08dd3ccd0f36335ad4bc6a1b5e2293b3fe0ab3af3d50c8830b6f7ff1eb885bcbeb38b36aa200f3cc4dd8097357727a01
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
2745070743
C2
cootembrast.com
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 4380 rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4392 4168 WerFault.exe 75 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4380 rundll32.exe 4380 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\67299ce0f6644ec5c4bc807f6cd5683b1755ca61f14ae4df0d34465801541e99.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4380
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 420 -p 4168 -ip 41681⤵PID:888
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4168 -s 17601⤵
- Program crash
PID:4392