Analysis
-
max time kernel
61s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
24/07/2022, 10:26
Static task
static1
Behavioral task
behavioral1
Sample
74bfaf0a78fe5953da255134e7effde5.dll
Resource
win7-20220718-en
4 signatures
150 seconds
General
-
Target
74bfaf0a78fe5953da255134e7effde5.dll
-
Size
96KB
-
MD5
74bfaf0a78fe5953da255134e7effde5
-
SHA1
4bb7d4382335f07d769df018020ac12d97966f8c
-
SHA256
93d5f66232bb4bb1ba391d54b9fcbe51d6339e5bddfedccce86e7786f4fc91fd
-
SHA512
1b2cbf657bd519914a6801969b92d7d08a6966b716a14773d6f569c726a791aa6a87902bb80eab08f916c0d4c95c74a9ee405bca84181a0a14f89a0d9dd66c35
Malware Config
Extracted
Family
icedid
Campaign
2937671378
C2
cootembrast.com
Signatures
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
flow pid Process 6 1836 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1836 rundll32.exe 1836 rundll32.exe