Analysis
-
max time kernel
131s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2022 17:14
Static task
static1
Behavioral task
behavioral1
Sample
stenciling.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
stenciling.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
stenciling.dll
-
Size
532KB
-
MD5
908846527f104b1f0aa5d4856716b682
-
SHA1
877c816a605450a86b6a24fce3977a693f60b4b0
-
SHA256
abc0382a20c86144086e39ccf107bb7702bde07dcc66a06967a01bc15f6a1432
-
SHA512
5c07ff9026a04b5ac10da2fad12376c1bbf759a6c88ce91511feedeaad351366338e3f1f93e5c56d6270654bbc2f1a13e88feed12a0bc788d6305540c3a7ee52
-
SSDEEP
6144:sEJT/WWRn8SwytzDTvCrQEgPL601iSvfkAierdcLh3lT:sEIypvCsbt1lvcFLvT
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
2537954433
C2
scainznorka.com
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 12 3140 rundll32.exe 37 3140 rundll32.exe 39 3140 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3140 rundll32.exe 3140 rundll32.exe