Analysis
-
max time kernel
43s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
24/07/2022, 12:53
Static task
static1
Behavioral task
behavioral1
Sample
f6ef59615b004419cc319022af6bbf7b.dll
Resource
win7-20220718-en
4 signatures
150 seconds
General
-
Target
f6ef59615b004419cc319022af6bbf7b.dll
-
Size
96KB
-
MD5
f6ef59615b004419cc319022af6bbf7b
-
SHA1
2b8fc3d5216bbc90b1c86e79b621882f69715868
-
SHA256
9d20d3560697238d166020ed3c964e06156495900507b055ac9e202a1ba0a7d0
-
SHA512
65d4396a998e9ccc82beb289315406992d714628590543816ae071077dd029dc7724d68d5b18c48cb7bdcf5a787baef48ef1589dc60ef7fd88c614d3d55cafe5
Malware Config
Extracted
Family
icedid
Campaign
2937671378
C2
cootembrast.com
Signatures
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 364 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 364 rundll32.exe 364 rundll32.exe