Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2022 06:02
Static task
static1
Behavioral task
behavioral1
Sample
2ja416p1.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2ja416p1.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
2ja416p1.dll
-
Size
91KB
-
MD5
7037e6f38bd7d97f6b291c2b1d63f4b8
-
SHA1
abb104e204cb5e38e4f913af03a8b79335c3e7af
-
SHA256
4d4375aa3867b395247df686e0aa83c59a6d109e56754450e87455fe510deb66
-
SHA512
27b96726e9e6be908aacffc924ec314ecc0b4fd2c3ed98d8da1e5669b8acaad6c62ebd643e01855e7e54c55c8e919d40545c59a54fc6cd1e51349c27867e1814
-
SSDEEP
1536:4kmo3Uy3PEXX01u4APFIzO55RGh8WKAYNvWEAueFPCV70W0GIQqcch9ypqlh/vYL:p3UyfEXXTKqMh8sYNvWEAnQ90Sqccjyx
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
1292139634
C2
oiurkastarting.com
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 14 4712 rundll32.exe 37 4712 rundll32.exe 40 4712 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 4712 rundll32.exe 4712 rundll32.exe