Behavioral task
behavioral1
Sample
1380-55-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1380-55-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win10v2004-20220812-en
General
-
Target
1380-55-0x0000000180000000-0x0000000180009000-memory.dmp
-
Size
36KB
-
MD5
815a8c1d6aa03d4e6077ff7c32eb6f7f
-
SHA1
efca0176c451c8739181a91f8758946a37964550
-
SHA256
f7b25bdb0c06a60b890db98f3b4d9c42a401c715b8c31f5d781f410cee8babbd
-
SHA512
73cf04065ebbff92ef55655ba7293b9285730776ef48b813b3e36b5266308b3946241611d92aa4b6d0193318c1f5c46d549ee30d9c509e7becd77b3d9e727af3
-
SSDEEP
192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgw7gXBAQYfPq/3Kbt:h1Mf0gJSix2AA56RCiZVoGQYnq/6b
Malware Config
Extracted
icedid
1048105134
rulescvosher.com
Signatures
-
Icedid family
Files
-
1380-55-0x0000000180000000-0x0000000180009000-memory.dmp.dll windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.c Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 6B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.r Size: 512B - Virtual size: 418B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.d Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE