Analysis
-
max time kernel
174s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2022 16:34
Static task
static1
Behavioral task
behavioral1
Sample
aebff99cbadfa1d5ddcd0167d2fc836e387dfaab2e4db85828ca2278b92c99fd.dll
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
General
-
Target
aebff99cbadfa1d5ddcd0167d2fc836e387dfaab2e4db85828ca2278b92c99fd.dll
-
Size
93KB
-
MD5
2d0c542bb0003b496617af097c843226
-
SHA1
2143c533d9845d2aac619fa322d4566b5db6e7fe
-
SHA256
aebff99cbadfa1d5ddcd0167d2fc836e387dfaab2e4db85828ca2278b92c99fd
-
SHA512
9fdaedd46755b232e1dc2d28de53a91ae4169f7679e17cbd1fcdc8b15a3c21bd0527047f7ad4f271b4c2e8b0914c183bf51f4819ee938b5d624f04bbc98f50e8
-
SSDEEP
1536:HFLEwtQY623O9IMSa+1oe+FlfkhWaRV5QQVw9W6:GsvMSa+We+XfkhWanlVmW6
Malware Config
Extracted
Family
icedid
C2
explodevices.top
Signatures
-
IcedID First Stage Loader 3 IoCs
Processes:
resource yara_rule behavioral2/memory/228-133-0x0000000000B30000-0x0000000000B38000-memory.dmp IcedidFirstLoader behavioral2/memory/228-137-0x0000000000CF0000-0x0000000000CF6000-memory.dmp IcedidFirstLoader behavioral2/memory/228-140-0x0000000000B10000-0x0000000000B15000-memory.dmp IcedidFirstLoader -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4528 wrote to memory of 228 4528 regsvr32.exe regsvr32.exe PID 4528 wrote to memory of 228 4528 regsvr32.exe regsvr32.exe PID 4528 wrote to memory of 228 4528 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\aebff99cbadfa1d5ddcd0167d2fc836e387dfaab2e4db85828ca2278b92c99fd.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\aebff99cbadfa1d5ddcd0167d2fc836e387dfaab2e4db85828ca2278b92c99fd.dll2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/228-132-0x0000000000000000-mapping.dmp
-
memory/228-133-0x0000000000B30000-0x0000000000B38000-memory.dmpFilesize
32KB
-
memory/228-137-0x0000000000CF0000-0x0000000000CF6000-memory.dmpFilesize
24KB
-
memory/228-140-0x0000000000B10000-0x0000000000B15000-memory.dmpFilesize
20KB