Behavioral task
behavioral1
Sample
864-54-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
864-54-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win10v2004-20220812-en
General
-
Target
864-54-0x0000000180000000-0x0000000180009000-memory.dmp
-
Size
36KB
-
MD5
31aed8815db91eee801317d68cb58cfc
-
SHA1
b7f583c9ac78ef03df791f2230f12e6f8db4a519
-
SHA256
646f6b497c5054bcb9a9e2241cabfe304dc4004796a0d21fe6250352bb5598d7
-
SHA512
374444cd89d135fb30bba140194ac2b584bcebe3e706c356102d5831305995686375fdf4a671d829ee1fbfb6f8a9228ecb71114b80e28abfe4498eaabe8e5b30
-
SSDEEP
192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwbwwXBAQYfPq/3KbyM:h1Mf0gJSix2AA56RCiZVFwCGQYnq/6b
Malware Config
Extracted
icedid
3228182693
tezycronam.com
Signatures
-
Icedid family
Files
-
864-54-0x0000000180000000-0x0000000180009000-memory.dmp.dll windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.c Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 6B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.r Size: 512B - Virtual size: 418B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.d Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE