Analysis
-
max time kernel
44s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
24/07/2022, 08:16
Static task
static1
Behavioral task
behavioral1
Sample
da8b0dfc72b00e8dbd27f4452720c529.dll
Resource
win7-20220718-en
4 signatures
150 seconds
General
-
Target
da8b0dfc72b00e8dbd27f4452720c529.dll
-
Size
96KB
-
MD5
da8b0dfc72b00e8dbd27f4452720c529
-
SHA1
388f93417a9765053283a21f552ef8e8ef021fea
-
SHA256
bfd2544f6cb03ada9421496069c9c523e61ba2c905fdbb718c2c8f63ff3c5167
-
SHA512
557b651e0975c9b890d6010f58404b0c62e2775ea1c298ed62c500036fa2475fd4313a2f66ed4baa711cffd67750e25343b06469c30f9722cc1dc939c2336069
Malware Config
Extracted
Family
icedid
Campaign
2937671378
C2
cootembrast.com
Signatures
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 960 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 960 rundll32.exe 960 rundll32.exe