Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2022 06:08
Static task
static1
Behavioral task
behavioral1
Sample
6849p005.dll
Resource
win7-20220901-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6849p005.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
6849p005.dll
-
Size
91KB
-
MD5
e93adbd7ef31f56b0debb57d3f5c0d6a
-
SHA1
5e116882001fcbe343d409d742d08151c18ed433
-
SHA256
01a0c5704317c28d31607db9a2b484faa214dd3b0781fa201ba27d3d7dbb9b60
-
SHA512
d0dca9e8bcc6109aeef9ca3a3dce4372c773c6d5cad15f8d05e4f5527e635abb685000b64e38fd8207904a457d2d542692b94123bcbd2d698d266f66fc70a28a
-
SSDEEP
1536:Skmo3Uy3PEXX01u4APFIzO55RGh8WKAYNvWEAueFPCV70W0GIQqcch9ypqlh/vYL:P3UyfEXXTKqMh8sYNvWEAnQ90Sqccjyx
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
1292139634
C2
oiurkastarting.com
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 9 4932 rundll32.exe 51 4932 rundll32.exe 62 4932 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 4932 rundll32.exe 4932 rundll32.exe