Behavioral task
behavioral1
Sample
1464-65-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1464-65-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win10v2004-20220812-en
General
-
Target
1464-65-0x0000000180000000-0x0000000180009000-memory.dmp
-
Size
36KB
-
MD5
1052e13a3da3523f5e1ff8a75f903357
-
SHA1
411b5ddda8439a23cfb9b8bf3eb394aa10da7253
-
SHA256
bedbe67994d93b378858caebbacb84d4ee05fc7687c558cda53bcc235a4ad62e
-
SHA512
1f01b1479435b70acefe7843f6ce39aa382045a50f6efbae90cba380867a475cd1ece255e533d73ef1a0c9df74b6e5d73def258a79a09e5ef81c4402975719dc
-
SSDEEP
192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwNXXBAQYfPq/3Kbr:h1Mf0gJSix2AA56RCiZVrGQYnq/6b
Malware Config
Extracted
icedid
742081363
scainznorka.com
Signatures
-
Icedid family
Files
-
1464-65-0x0000000180000000-0x0000000180009000-memory.dmp.dll windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.c Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 6B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.r Size: 512B - Virtual size: 418B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.d Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE