Analysis
-
max time kernel
91s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
24/07/2022, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
6fcb43a878c29b12a6f5991867aed103.dll
Resource
win7-20220718-en
4 signatures
150 seconds
General
-
Target
6fcb43a878c29b12a6f5991867aed103.dll
-
Size
96KB
-
MD5
6fcb43a878c29b12a6f5991867aed103
-
SHA1
40c91f1a93bebd623e279a99ef2d0fc79eabe78e
-
SHA256
6cf32ee5903e799badc85f4a43bdcd46a5a8e2c9f062bf3242f07cbe6362f5d2
-
SHA512
d4ac8556eaddd5c6641e21df916ac415ab5c0bd9d2c052683f2739e81863840efa6b2119efeb71e13db5d0cc4fa60e02d947c736f2900619e4503f2ab9236da9
Malware Config
Extracted
Family
icedid
Campaign
2937671378
C2
cootembrast.com
Signatures
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
flow pid Process 9 1308 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1308 rundll32.exe 1308 rundll32.exe