Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
16-11-2022 22:54
Static task
static1
Behavioral task
behavioral1
Sample
file.dll
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
file.dll
-
Size
95KB
-
MD5
c40b908d0723229b8fe209802077bb6c
-
SHA1
ab78490c6c4c7372ee23cc6ab56aa932b989aa24
-
SHA256
bec61c5d3e29f907640bc484b0c73faf76e9df9d7e3b4d28449ece5831b62edd
-
SHA512
f72eb76511412780be901578378bd106c43ace88aa74b321d3b3c66ad24b612b1e08a2363d3ef66665101bfe6496b9df8c077e1987b7ea046f2e31551486cb1a
-
SSDEEP
1536:jiS5J5mGsuP1BThFbA+d0oKcltodmrb73AYM+OAMNFqVb8ywRywi7sn:ji85fRbA+d0j4tDHwYmNib8ywRHi7sn
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
1626240797
C2
aurasantisflork.com
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 8 3272 rundll32.exe 31 3272 rundll32.exe 33 3272 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3272 rundll32.exe 3272 rundll32.exe