Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2024 11:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f4cea8a52aa64b95c9d0bf6c3396a1b0N.dll
Resource
win7-20240903-en
windows7-x64
5 signatures
120 seconds
General
-
Target
f4cea8a52aa64b95c9d0bf6c3396a1b0N.dll
-
Size
188KB
-
MD5
f4cea8a52aa64b95c9d0bf6c3396a1b0
-
SHA1
397b1dadfa55af99d845e5b4c4f2fcb76f814816
-
SHA256
1ba120d35654b6bd0559147c467d063c0e5c484c5940ac6505953a32d8fef917
-
SHA512
bfaa8794dd2cf96574232c20a0025058f8ca21a9cd7b4c361b4ec11d563ae978b4702a6d1ad598974cd7646696c839532a741006d797bcdf2532ae015b09b010
-
SSDEEP
3072:AibFFA003t401K/EKK0LKA7/D5N+gHPVcbW6GGix93yYDB:AIo3DAs0L1VXafix9P
Malware Config
Extracted
Family
icedid
C2
loadlisboa.casa
Signatures
-
IcedID First Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4312-1-0x0000000010000000-0x0000000010400000-memory.dmp IcedidFirstLoader behavioral2/memory/4312-4-0x0000000010000000-0x0000000010400000-memory.dmp IcedidFirstLoader -
Blocklisted process makes network request 10 IoCs
Processes:
rundll32.exeflow pid process 24 4312 rundll32.exe 32 4312 rundll32.exe 41 4312 rundll32.exe 44 4312 rundll32.exe 47 4312 rundll32.exe 55 4312 rundll32.exe 58 4312 rundll32.exe 60 4312 rundll32.exe 66 4312 rundll32.exe 69 4312 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4464 wrote to memory of 4312 4464 rundll32.exe rundll32.exe PID 4464 wrote to memory of 4312 4464 rundll32.exe rundll32.exe PID 4464 wrote to memory of 4312 4464 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f4cea8a52aa64b95c9d0bf6c3396a1b0N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f4cea8a52aa64b95c9d0bf6c3396a1b0N.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:4312