Analysis
-
max time kernel
59s -
max time network
63s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2022, 18:06
Static task
static1
Behavioral task
behavioral1
Sample
2ee40012e626797b12f298831513f59f.dll
Resource
win7-20220718-en
4 signatures
150 seconds
General
-
Target
2ee40012e626797b12f298831513f59f.dll
-
Size
110KB
-
MD5
2ee40012e626797b12f298831513f59f
-
SHA1
13737feeb9a7e31d7d96a1347e716ccdcfec9e81
-
SHA256
3b3bd596fa6072e11f27cd06f551bed06cdb3543ceaaf1d3f483cfa0b58c480d
-
SHA512
bad89b75896bfa262068114aa6d92c90f3352c0086593fb7a866444bc56a3469adc2680b80c27c51705aa63f35b7df0e5a455fe6ccffdc30c08442ae0e86d18b
Malware Config
Extracted
Family
icedid
Campaign
244156380
C2
garbagewellduno.com
Signatures
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
flow pid Process 5 4332 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4332 rundll32.exe 4332 rundll32.exe