Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 14:28
Static task
static1
Behavioral task
behavioral1
Sample
3a7141ec999f7e30f9741a95d881fa47ad848439952b27d05e412318bccdc963.dll
Resource
win7-20241023-en
General
-
Target
3a7141ec999f7e30f9741a95d881fa47ad848439952b27d05e412318bccdc963.dll
-
Size
216KB
-
MD5
c9a4c9f7ead1968956f3b186596a6ce3
-
SHA1
27f566355c2fa7d960c4aecaa9421141d423df26
-
SHA256
3a7141ec999f7e30f9741a95d881fa47ad848439952b27d05e412318bccdc963
-
SHA512
470c2980d45ac39a477344ed2c78b685bc99ed2666da14cebbcd06237e24115cda3dd8232b8ff01bca6d9ae5a1dc78953c720c3e9febf69cb9e36439b9960961
-
SSDEEP
3072:YsP7XhcYMTl8Wf+muWNgZjQaQHQRrvPKNe+BFtr2YdOJ7ATUYAgs/wZ1Z8iFZ:X7X4apmuW2ZtK/Ftr2XJSVAj/wZHDL
Malware Config
Extracted
icedid
4253634279
saygoodbauy.cyou
lastsallways.cyou
foreversuccess.cyou
budnisjopper.cyou
-
auth_var
4
-
url_path
/audio/
Extracted
icedid
Signatures
-
Icedid family
-
IcedID Second Stage Loader 2 IoCs
resource yara_rule behavioral2/memory/2476-1-0x0000000010000000-0x000000001003F000-memory.dmp IcedidSecondLoader behavioral2/memory/2476-2-0x0000000010000000-0x000000001003F000-memory.dmp IcedidSecondLoader -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4936 wrote to memory of 2476 4936 rundll32.exe 83 PID 4936 wrote to memory of 2476 4936 rundll32.exe 83 PID 4936 wrote to memory of 2476 4936 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a7141ec999f7e30f9741a95d881fa47ad848439952b27d05e412318bccdc963.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a7141ec999f7e30f9741a95d881fa47ad848439952b27d05e412318bccdc963.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2476
-