Behavioral task
behavioral1
Sample
1812-54-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1812-54-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win10v2004-20220812-en
General
-
Target
1812-54-0x0000000180000000-0x0000000180009000-memory.dmp
-
Size
36KB
-
MD5
88b971d92380623f47242eb4127fd572
-
SHA1
0ed8becd939df1a1c12fcf58db8b66f32e3d9be7
-
SHA256
a56d4f940150b8a1db039fec7b17c66680a97a4e64e495a204603c165f1410ec
-
SHA512
397ccab9bef45101a0b60d75c3ff5b1961f6763c4c278f30b1264c85f71dd850b4724a4f79c5b6a6aeca0de69ba090970cd09db56b32b1e5772188483173312a
-
SSDEEP
192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwOSXBAQYfPq/3KbA:h1Mf0gJSix2AA56RCiZVg4GQYnq/6bA
Malware Config
Extracted
icedid
1609463178
trolspeaksunt.com
Signatures
-
Icedid family
Files
-
1812-54-0x0000000180000000-0x0000000180009000-memory.dmp.dll windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.c Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 6B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.r Size: 512B - Virtual size: 418B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.d Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE