icedid | 1324-67-0x0000000000120000-0x0000000000129000-memory[.]dmp

General

Target
1324-67-0x0000000000120000-0x0000000000129000-memory.dmp
Size 36KB
Sample240302-2c3hdsaa2z
SHA256 a571c1fdbdf3e7f2716b5e3ce4e504425ed67d7564116fd4921a0b8ff7208181
MD5 b93afbaf0bfb03ae3cfb915f7b5be8f0
SHA1 d6a03db1c6608d5077ec2bc6659f580f60fabb57
SHA512 def5bac78c8dc5de2e73b362d11fda34de0beaab64062605df2e5f46a277aca7efb69ded531876fd8e1ced17cb13a843dfba6b813297580c2987e00436bd6f0d
SSDEEP 192:6P+nM5KC/zxayGc3gzq7YjDaqzJCueT+RfbZne9s6PLOWywP0tkYGijY:s5Jxayczq7Yjt9lfle9s6PLfv6kYGi8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

loader 946873669 icedid

Malware Config

Extracted

Family

icedid

Campaign

946873669

C2

umoxlopator.com

Signatures

Icedid family
icedid

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1324-67-0x0000000000120000-0x0000000000129000-memory.dmp

File Explorer

1324-67-0x0000000000120000-0x0000000000129000-memory.dmp

.dll 36KB

1324-67-0x0000000000120000-0x0000000000129000-memory.dmp

SHA256 a571c1fdbdf3e7f2716b5e3ce4e504425ed67d7564116fd4921a0b8ff7208181
MD5 b93afbaf0bfb03ae3cfb915f7b5be8f0
SHA1 d6a03db1c6608d5077ec2bc6659f580f60fabb57
SHA512 def5bac78c8dc5de2e73b362d11fda34de0beaab64062605df2e5f46a277aca7efb69ded531876fd8e1ced17cb13a843dfba6b813297580c2987e00436bd6f0d
SSDEEP 192:6P+nM5KC/zxayGc3gzq7YjDaqzJCueT+RfbZne9s6PLOWywP0tkYGijY:s5Jxayczq7Yjt9lfle9s6PLfv6kYGi8
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Name

.c

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text

Size

512B

Virtual Size

6B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.r

Size

512B

Virtual Size

416B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.d

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

1324-67-0x0000000000120000-0x0000000000129000-memory.dmp

generic