Behavioral task
behavioral1
Sample
b73a14100259d7012e4bbba0bdef3c838f03de4b648aa939be06d5aa356568bc.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
b73a14100259d7012e4bbba0bdef3c838f03de4b648aa939be06d5aa356568bc.exe
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
b73a14100259d7012e4bbba0bdef3c838f03de4b648aa939be06d5aa356568bc.exe
Resource
win10v2004-20230220-en
General
-
Target
b73a14100259d7012e4bbba0bdef3c838f03de4b648aa939be06d5aa356568bc.exe
-
Size
13KB
-
MD5
dbc06b6b30bfccfc16115ab07eeacb64
-
SHA1
eef38d76edf43b803341ba471ade11b715e80a47
-
SHA256
b73a14100259d7012e4bbba0bdef3c838f03de4b648aa939be06d5aa356568bc
-
SHA512
0bea203b3e9b88eb1cd47797f1faa80ba13819a5526f3d6ca43f3aa935f502f193685fc20f81859167b83347272a7280f591c00f86471c3dcc26d1f2dd6f54a3
-
SSDEEP
192:c5nU7ThdZzpk4EJmxQQTHGKZFTkUV2U+A5+ZrCi5UB58xf+rs:c5Un3Zz6mxQNqNVH+A5+ZrCi2B8f+rs
Malware Config
Extracted
icedid
1224841727
sithoparka.com
Signatures
-
Icedid family
Files
-
b73a14100259d7012e4bbba0bdef3c838f03de4b648aa939be06d5aa356568bc.exe.exe windows x64
7da7944dd09a50ac9764ef71fea6691a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shell32
SHGetFolderPathA
msvcrt
memset
winhttp
WinHttpOpenRequest
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpSetStatusCallback
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
kernel32
HeapReAlloc
WideCharToMultiByte
lstrlenW
VirtualProtect
VirtualAlloc
lstrcatA
lstrcpyA
CreateDirectoryA
LoadLibraryA
GetProcAddress
GetComputerNameExW
GetTickCount64
SwitchToThread
CreateFileA
ReadFile
GetTempPathA
CloseHandle
WaitForSingleObject
Sleep
ExitProcess
CreateThread
GetTickCount
WriteFile
HeapAlloc
HeapFree
GetProcessHeap
GetLastError
advapi32
GetUserNameW
LookupAccountNameW
user32
wsprintfW
wsprintfA
Sections
.c Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.r Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.d Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE