Resubmissions
19-12-2022 02:21
221219-ctd4paea95 315-12-2022 18:02
221215-wmvbwada34 1015-12-2022 18:01
221215-wl6nhsda29 115-12-2022 18:01
221215-wl1ghafh7y 3Analysis
-
max time kernel
86s -
max time network
99s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
15-12-2022 18:02
Static task
static1
Behavioral task
behavioral1
Sample
tmpFB1E.dll
Resource
win7-20220901-en
windows7-x64
3 signatures
150 seconds
General
-
Target
tmpFB1E.dll
-
Size
269KB
-
MD5
c7ca67a72a6cad3fc366e6e172539859
-
SHA1
fd1855605f49c59a0894f7a8b848303eb099f496
-
SHA256
c705008b6656feabe462ebb2363d6a259581cea574872cb1c6c440dbd23ad4fa
-
SHA512
5727151a1e2680fd482fa8a882ead4242c1f96b4119f0c7672fc7a5b5d2df8a226b15dc69f6ce0f7ccfe17510f21a0af4c23ecb000bda6f29252daf724c16fbd
-
SSDEEP
6144:MTHJ5BU2WigC+/NZy40onBQ14xdN8IcfSLZ:qDB0igC+/NHBQ1SdwSd
Malware Config
Extracted
Family
icedid
Campaign
787509923
C2
kamintrewftor.com
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 2 1128 rundll32.exe 4 1128 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 1128 rundll32.exe 1128 rundll32.exe 1128 rundll32.exe 1128 rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1128-54-0x0000000000120000-0x0000000000129000-memory.dmpFilesize
36KB