Behavioral task
behavioral1
Sample
f47ca6d0655a09d8cbc1a02e93899f07a2bf090a35baef342bf50e38cbbc5c6e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f47ca6d0655a09d8cbc1a02e93899f07a2bf090a35baef342bf50e38cbbc5c6e.exe
Resource
win10-20220901-en
General
-
Target
f47ca6d0655a09d8cbc1a02e93899f07a2bf090a35baef342bf50e38cbbc5c6e.exe
-
Size
13KB
-
MD5
c85386a1101c416dcb625efe76bf02f4
-
SHA1
fc0bc5203ae81011d869a3d4945310d5b6b58245
-
SHA256
f47ca6d0655a09d8cbc1a02e93899f07a2bf090a35baef342bf50e38cbbc5c6e
-
SHA512
8e0fab3775121c80bf2ab19aa0ef6ae44f06040c4a0af45d1250f82253f415dccdf508c20a60c3f43ace773f3b63fefd7ed9b64a1de84f4b050e9568b09d7422
-
SSDEEP
192:7KbCHpfVTIFyzPDufy2yz7ZBKUFf636yXxjt5PM6E632:7KbCHFHzmy1z1896yhE6E632
Malware Config
Extracted
icedid
1454132006
umousteraton.com
Signatures
-
Icedid family
Files
-
f47ca6d0655a09d8cbc1a02e93899f07a2bf090a35baef342bf50e38cbbc5c6e.exe.exe windows x64
64073750f54905ba99204d8fcc786d0d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
wsprintfW
kernel32
HeapAlloc
HeapFree
GetProcessHeap
CreateFileA
WriteFile
CloseHandle
HeapReAlloc
GetLastError
ExitProcess
GetTickCount64
GetComputerNameExW
GetProcAddress
LoadLibraryA
CreateDirectoryA
GetTempPathA
Sleep
lstrcpyA
lstrcatA
VirtualAlloc
SwitchToThread
lstrlenW
WideCharToMultiByte
VirtualProtect
advapi32
GetUserNameW
LookupAccountNameW
msvcrt
memset
winhttp
WinHttpQueryHeaders
WinHttpSetStatusCallback
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
shell32
SHGetFolderPathA
Sections
.c Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.r Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.d Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE