Analysis
-
max time kernel
113s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
02-07-2023 19:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Malicious_dcbefcad847bd1645f5ecd833665b8d4a03b9d26bd44382b8b74c0aa4e6f13e6.dll
Resource
win7-20230621-en
windows7-x64
3 signatures
150 seconds
General
-
Target
Malicious_dcbefcad847bd1645f5ecd833665b8d4a03b9d26bd44382b8b74c0aa4e6f13e6.dll
-
Size
64KB
-
MD5
cc71d9565418060f330b15e4be338939
-
SHA1
69bd0dda49200a298b0ff25ad7049e293f97fe71
-
SHA256
dcbefcad847bd1645f5ecd833665b8d4a03b9d26bd44382b8b74c0aa4e6f13e6
-
SHA512
0b524563f892feda2f5cfc895360012243b40d6f8912e054dcf8a95c1fb736b680d2dc9721daa24278bbad44604dc594f017b2237ce159b400abb9060fb77abe
-
SSDEEP
1536:roBHSfku/TguqNKM6C6E+YUv3EXmYOiKsU:roBS8Q0R68Xys
Malware Config
Extracted
Family
icedid
Campaign
2046050
C2
calldivorce.fun
Signatures
-
IcedID First Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1996-54-0x0000000000130000-0x0000000000137000-memory.dmp IcedidFirstLoader behavioral1/memory/1996-55-0x0000000000130000-0x0000000000137000-memory.dmp IcedidFirstLoader -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 1996 regsvr32.exe 1996 regsvr32.exe