Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2023 09:24
Static task
static1
Behavioral task
behavioral1
Sample
problem_2.dll
Resource
win7-20221111-en
windows7-x64
4 signatures
150 seconds
General
-
Target
problem_2.dll
-
Size
178KB
-
MD5
0defacf9edf30d2f5abe16fef26d92ac
-
SHA1
1d0e229fe28c42cf25f4f688bad9925864a08193
-
SHA256
800e53e7acb97419f42d8c82e9c34a2810ebbbe98058f580719ab83e70be435c
-
SHA512
5f98b4fa840da710af2581fc91999596cfe10d0fc3eb25922cd5d13669abeb070169e95fe9690010d085da34f09fe0c873266b948eab3d1dada3a47571b61e6a
-
SSDEEP
3072:dRNOtBIEa2A/k3xTCD4xugYOpddiT+t1xLyRlu94OApLnjWEV2rdSu:rNQIEaH/W80xugYOpHiT+t10Rlu943kd
Malware Config
Extracted
Family
icedid
C2
qapoloki.cyou
Signatures
-
IcedID First Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral2/memory/432-133-0x0000000075510000-0x0000000075516000-memory.dmp IcedidFirstLoader behavioral2/memory/432-134-0x0000000075510000-0x0000000075548000-memory.dmp IcedidFirstLoader -
Blocklisted process makes network request 13 IoCs
Processes:
rundll32.exeflow pid process 18 432 rundll32.exe 34 432 rundll32.exe 36 432 rundll32.exe 39 432 rundll32.exe 40 432 rundll32.exe 43 432 rundll32.exe 48 432 rundll32.exe 50 432 rundll32.exe 52 432 rundll32.exe 54 432 rundll32.exe 57 432 rundll32.exe 61 432 rundll32.exe 70 432 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3092 wrote to memory of 432 3092 rundll32.exe rundll32.exe PID 3092 wrote to memory of 432 3092 rundll32.exe rundll32.exe PID 3092 wrote to memory of 432 3092 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\problem_2.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\problem_2.dll,#12⤵
- Blocklisted process makes network request