Behavioral task
behavioral1
Sample
inject.exe
Resource
win7-20221111-es
Behavioral task
behavioral2
Sample
inject.exe
Resource
win10-20220812-es
General
-
Target
inject.exe
-
Size
16KB
-
MD5
153dc369ae15758d950f99dbf102c28f
-
SHA1
32be8cc4e15f031f2f87ea783967cec6cd014e5e
-
SHA256
884cdf248d0235d77adc1d88603d460d64c88c517d5e571b75749be42364d6a8
-
SHA512
18b22affb1a86c2c40b9574d28c11ccda5a5aad603535fcacf4cc2f97891a250faf3108cb90f81070a53aad5bcfd289cb171ccb1f86bb99f99b0ad7d6423b99b
-
SSDEEP
192:/ZKbCHpfVTIFyzPDufy2yz7ZBKUFf636yXoMV5PM6E632:xKbCHFHzmy1z1896yHM6E632
Malware Config
Extracted
icedid
3248465841
qsertopinajil.com
Signatures
-
Icedid family
Files
-
inject.exe.exe windows x64
64073750f54905ba99204d8fcc786d0d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
wsprintfW
kernel32
HeapAlloc
HeapFree
GetProcessHeap
CreateFileA
WriteFile
CloseHandle
HeapReAlloc
GetLastError
ExitProcess
GetTickCount64
GetComputerNameExW
GetProcAddress
LoadLibraryA
CreateDirectoryA
GetTempPathA
Sleep
lstrcpyA
lstrcatA
VirtualAlloc
SwitchToThread
lstrlenW
WideCharToMultiByte
VirtualProtect
advapi32
GetUserNameW
LookupAccountNameW
msvcrt
memset
winhttp
WinHttpQueryHeaders
WinHttpSetStatusCallback
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
shell32
SHGetFolderPathA
Sections
.c Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 6B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 512B - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.r Size: 512B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.d Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE