Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
02-07-2023 19:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Malicious_e0ebff1821ecd5cd958dff9da365733c8cd8a996481cbbd5430eea6da5c52aef.dll
Resource
win7-20230621-en
windows7-x64
3 signatures
150 seconds
General
-
Target
Malicious_e0ebff1821ecd5cd958dff9da365733c8cd8a996481cbbd5430eea6da5c52aef.dll
-
Size
64KB
-
MD5
de6e94136c457a64f27ee6d16e1db992
-
SHA1
ecbd1d607dff80343c51038177adb9ef6004be22
-
SHA256
e0ebff1821ecd5cd958dff9da365733c8cd8a996481cbbd5430eea6da5c52aef
-
SHA512
be7da9fe5f3fe2059d3a4c339722fc3c3c55f3e5bc1df5a3f8cc032d886dd2b487f03ab118d63e2266bea08b74e1be7f15cd60e6a8291b135674096114cc1cd7
-
SSDEEP
1536:roBHSfku/TguqNKM6C6E+YUv3EXmYOiKsU:roBS8Q0R68Xys
Malware Config
Extracted
Family
icedid
Campaign
2046050
C2
calldivorce.fun
Signatures
-
IcedID First Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2532-133-0x0000000000E60000-0x0000000000E67000-memory.dmp IcedidFirstLoader behavioral2/memory/2532-134-0x0000000000E60000-0x0000000000E67000-memory.dmp IcedidFirstLoader -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2532 regsvr32.exe 2532 regsvr32.exe