Behavioral task
behavioral1
Sample
908-54-0x0000000180000000-0x0000000180005000-memory.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
908-54-0x0000000180000000-0x0000000180005000-memory.dll
Resource
win10v2004-20220812-en
General
-
Target
908-54-0x0000000180000000-0x0000000180005000-memory.dmp
-
Size
20KB
-
MD5
edc61fdd4094a7a4ea0375f631caacaa
-
SHA1
9eab3c0c59539e553ba75322eea20aca64abdcf8
-
SHA256
5b8eb78a6dd4358c17dd052732aca627426474f788a8fc53497c52f670ccaa28
-
SHA512
c3d0ff34ba66639feecdae533d30edc34c3c0d327f3befab8d4463cc355270622cb69117673ee89cbdcdc4ec743dbdd54c0a810af0338bffcbd8ca98b3082c3e
-
SSDEEP
96:CAVCUOemFbOCsnsLoBTp95Ia3tsRaAyDI6QpaW0LUE:CApOjr4sLETniadwy0naz
Malware Config
Extracted
icedid
536628885
guaracheza.pics
stayersa.art
-
auth_var
9
-
url_path
/news/
Signatures
-
Icedid family
Files
-
908-54-0x0000000180000000-0x0000000180005000-memory.dmp.dll windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 884B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 108B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ