Analysis
-
max time kernel
111s -
max time network
115s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-11-2022 06:39
Static task
static1
Behavioral task
behavioral1
Sample
8960t227.6n7.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
8960t227.6n7.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
8960t227.6n7.dll
-
Size
91KB
-
MD5
e8c3b0775526896858aeaceb1eba7ffd
-
SHA1
fc770c507fdb67bf294c78466b42719b3dc13253
-
SHA256
59ecbf50bc1e38864728e19ae15ffead87a59d7274002508656292b057665c63
-
SHA512
2a338a38af966c7c0b799e96365f9cb7779590f7921cc6faeb1d9be13453a561c32fa5c98733c5566e0c84aced9f68c86fb0c56447327729b4e834962d6be054
-
SSDEEP
1536:jkmo3Uy3PEXX01u4APFIzO55RGh8WKAYNvWEAueFPCV70W0GIQqcch9ypqlh/vYL:83UyfEXXTKqMh8sYNvWEAnQ90Sqccjyx
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
1292139634
C2
oiurkastarting.com
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 2 1660 rundll32.exe 6 1660 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1660 rundll32.exe 1660 rundll32.exe