Malware Analysis Report

2025-08-06 04:21

Sample ID 220720-qj52bafhhl
Target 27cd8f040ec3fc2125aa9a2cfedc8f4e3abf73aa2ed1bc9ab52aa977177ac952 (1).bin
SHA256 27cd8f040ec3fc2125aa9a2cfedc8f4e3abf73aa2ed1bc9ab52aa977177ac952
Tags
loader 3000901376 icedid
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

27cd8f040ec3fc2125aa9a2cfedc8f4e3abf73aa2ed1bc9ab52aa977177ac952

Threat Level: Known bad

The file 27cd8f040ec3fc2125aa9a2cfedc8f4e3abf73aa2ed1bc9ab52aa977177ac952 (1).bin was found to be: Known bad.

Malicious Activity Summary

loader 3000901376 icedid

Icedid family

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2022-07-20 13:18

Signatures

Icedid family

icedid

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-20 13:18

Reported

2022-07-20 13:21

Platform

win10-20220414-en

Max time kernel

144s

Max time network

147s

Command Line

regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\27cd8f040ec3fc2125aa9a2cfedc8f4e3abf73aa2ed1bc9ab52aa977177ac952 (1).dll"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\27cd8f040ec3fc2125aa9a2cfedc8f4e3abf73aa2ed1bc9ab52aa977177ac952 (1).dll"

Network

Country Destination Domain Proto
US 8.8.8.8:53 yolneanz.com udp
US 20.189.173.9:443 tcp
NL 104.110.191.140:80 tcp
US 8.8.8.8:53 yolneanz.com udp
US 8.8.8.8:53 yolneanz.com udp

Files

N/A