Analysis
-
max time kernel
131s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17-08-2022 16:29
Static task
static1
Behavioral task
behavioral1
Sample
y2D0B.tmp.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
y2D0B.tmp.dll
-
Size
352KB
-
MD5
a199abb4e2297ad76b4fae8f84d78f97
-
SHA1
4c02d79a7fd2540098c8866066be306393368d91
-
SHA256
9cb147d008d7edd6829bd80f163d0bc5ae5063ca75b9e6c020d40398acf0701f
-
SHA512
7231e7448785e40f4ce4bedf7a51a6e622cf28e92020928bac4f2202883bd51f5e12e96e8db0b06133d2a068b7bdd27a95aaba6404288d7b394209b3c60af2c6
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
3570055661
C2
alexbionka.com
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 9 1988 rundll32.exe 24 1988 rundll32.exe 26 1988 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1988 rundll32.exe 1988 rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1988-132-0x0000000180000000-0x0000000180009000-memory.dmpFilesize
36KB