Analysis
-
max time kernel
131s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-09-2022 11:10
Static task
static1
Behavioral task
behavioral1
Sample
66e18a529faaa8de957ab41fb3a49ad8f0fcb497a91d85b86d4a64d05987b3b3.dll
Resource
win7-20220901-en
windows7-x64
3 signatures
150 seconds
General
-
Target
66e18a529faaa8de957ab41fb3a49ad8f0fcb497a91d85b86d4a64d05987b3b3.dll
-
Size
59KB
-
MD5
0a8120f34869c3922014ce2bf9260204
-
SHA1
871641fa487fdcb6c82cab5c521605ecc71a4f11
-
SHA256
66e18a529faaa8de957ab41fb3a49ad8f0fcb497a91d85b86d4a64d05987b3b3
-
SHA512
3d85529e71c10787922891e9f5c517447c8938f14f61833dc7bd1c03a5c358650b3559d23b9715f9297f5247802b7e65cd23780ad5a242e30625f060ac272eb3
-
SSDEEP
1536:BfrkExjpSKcsAXXV7QobSqDLbpsX1jpb9dgwhm+:BzlxjpzcsKXDS0XU1tbjgwV
Malware Config
Extracted
Family
icedid
Campaign
277711618
C2
bransfortrionaf.com
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 13 4112 rundll32.exe 39 4112 rundll32.exe 46 4112 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 4112 rundll32.exe 4112 rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4112-132-0x0000000180000000-0x0000000180009000-memory.dmpFilesize
36KB