Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
02/07/2023, 19:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Malicious_b6cd234b8440764f61195d5a984b6f279ef350dbc9a98d573a2a2abfb509913a.dll
Resource
win7-20230621-en
3 signatures
150 seconds
General
-
Target
Malicious_b6cd234b8440764f61195d5a984b6f279ef350dbc9a98d573a2a2abfb509913a.dll
-
Size
64KB
-
MD5
3790fbb29e8e00770dd1b46fb5339eb9
-
SHA1
d6fa153b30822c942cdff0bc99749fbb5d3bc766
-
SHA256
b6cd234b8440764f61195d5a984b6f279ef350dbc9a98d573a2a2abfb509913a
-
SHA512
4efc0ad2334ca76a5cded797d25b29266d0d179c87c6e90de73ad3b62bebd0c59b7753631e27c282cbce004c385283bdf0fcfdd68fb1301c098ea3f7be12904b
-
SSDEEP
1536:roBHSfku/TguqNKM6C6E+YUv3EXmYOiKsU:roBS8Q0R68Xys
Malware Config
Extracted
Family
icedid
Campaign
2046050
C2
calldivorce.fun
Signatures
-
IcedID First Stage Loader 2 IoCs
resource yara_rule behavioral2/memory/1012-133-0x0000000001150000-0x0000000001157000-memory.dmp IcedidFirstLoader behavioral2/memory/1012-134-0x0000000001150000-0x0000000001157000-memory.dmp IcedidFirstLoader -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1012 regsvr32.exe 1012 regsvr32.exe