Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
16-11-2022 23:39
Static task
static1
Behavioral task
behavioral1
Sample
subtract_lost.dll
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
subtract_lost.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
subtract_lost.dll
-
Size
95KB
-
MD5
2281d8971802ab0d1ae4282f26ff95cc
-
SHA1
8636c460bdd97d8121e1f00f36d0c8b6bf93ac06
-
SHA256
769cc60e51053a6fefc4e4e167692ef23afab2cd2d6f404ed4fb35b81b82813d
-
SHA512
2c0c0ccd4f7f54d8b6d013962cba0124b196f50e4ede0ededad08c2ce3f1365a6ce020a88e0dd7c54165335c3a75c72ec6a07860a1542d04e464a3b63a778323
-
SSDEEP
1536:1y5k7TI5OMPHJ0u25+bCHxMBUZfbKIW4o5mEC6iExd3I+/7CDwrwzLNnIdJDbyHs:z7TI0MBFbCHxMMu45ECXEzYfLtM
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
1626240797
C2
aurasantisflork.com
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 2 1640 rundll32.exe 4 1640 rundll32.exe 5 1640 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1640 rundll32.exe 1640 rundll32.exe