Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2023 09:23
Static task
static1
Behavioral task
behavioral1
Sample
prob_3.dll
Resource
win7-20220901-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
prob_3.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
prob_3.dll
-
Size
185KB
-
MD5
87dc37e0edb39c077c4d4d8f1451402c
-
SHA1
4a45780d3872ae1462a85e5f711f753260f8d7df
-
SHA256
b21f9afc6443548427bf83b5f93e7a54ac3af306d9d71b8348a6f146b2819457
-
SHA512
0c315c056ac2aec977cc80c7c53cf3a118ee86ced8203437eddff6a8e653256153e8469055b7efd40796c1e1695e346b6ca65d90d70fee248e4dd8166909389e
-
SSDEEP
3072:uXpAQlUasEbieV/gltztsCvq2mv0u+EKX9E0JfHIQL:uXtUPvtsyqfCJJH7
Score
10/10
Malware Config
Extracted
Family
icedid
Botnet
2634746917
C2
june85.cyou
golddisco.top
Attributes
-
auth_var
4
-
url_path
/audio/
Extracted
Family
icedid
Signatures
-
IcedID Second Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3668-133-0x0000000074900000-0x0000000074906000-memory.dmp IcedidSecondLoader behavioral2/memory/3668-134-0x0000000074900000-0x000000007493E000-memory.dmp IcedidSecondLoader -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4280 wrote to memory of 3668 4280 rundll32.exe rundll32.exe PID 4280 wrote to memory of 3668 4280 rundll32.exe rundll32.exe PID 4280 wrote to memory of 3668 4280 rundll32.exe rundll32.exe