Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
ikvNEF5d2Z

Overview

General Information

Sample Name:ikvNEF5d2Z (renamed file extension from none to dll)
Analysis ID:651259
MD5:dfa62565b68736dc443386d68388b269
SHA1:d64a755f001658c7bc037049259f23807105d8ba
SHA256:6f57eb37bff30df1a66f848cb648799536dcbc05f6fb32d1ae071102ffd830ee
Infos:

Detection

IcedID
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
System process connects to network (likely due to code injection or exploit)
Multi AV Scanner detection for submitted file
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Snort IDS alert for network traffic
Yara detected IcedID
Tries to detect virtualization through RDTSC time measurements
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Tries to load missing DLLs
May sleep (evasive loops) to hinder dynamic analysis
Registers a DLL
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
Creates a process in suspended mode (likely to inject code)

Classification

  • System is w10x64
  • loaddll64.exe (PID: 6552 cmdline: loaddll64.exe "C:\Users\user\Desktop\ikvNEF5d2Z.dll" MD5: 4E8A40CAD6CCC047914E3A7830A2D8AA)
    • cmd.exe (PID: 6568 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ikvNEF5d2Z.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • rundll32.exe (PID: 6588 cmdline: rundll32.exe "C:\Users\user\Desktop\ikvNEF5d2Z.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)
    • regsvr32.exe (PID: 6576 cmdline: regsvr32.exe /s C:\Users\user\Desktop\ikvNEF5d2Z.dll MD5: D78B75FC68247E8A63ACBA846182740E)
    • rundll32.exe (PID: 6596 cmdline: rundll32.exe C:\Users\user\Desktop\ikvNEF5d2Z.dll,DllRegisterServer MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 6804 cmdline: rundll32.exe C:\Users\user\Desktop\ikvNEF5d2Z.dll,PluginInit MD5: 73C519F050C20580F8A62C849D49215A)
  • cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
00000002.00000003.321553577.000000000119D000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_IcedID_1Yara detected IcedIDJoe Security
    00000002.00000003.267642045.00000000011B1000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_IcedID_1Yara detected IcedIDJoe Security
      00000003.00000003.274029943.000001599AEC2000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_IcedID_1Yara detected IcedIDJoe Security
        00000003.00000003.261454717.000001599AEC2000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_IcedID_1Yara detected IcedIDJoe Security
          00000002.00000003.269643903.00000000011B1000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_IcedID_1Yara detected IcedIDJoe Security
            Click to see the 88 entries
            No Sigma rule has matched
            Timestamp:192.168.2.38.8.8.858716532023883 06/23/22-18:01:43.082878
            SID:2023883
            Source Port:58716
            Destination Port:53
            Protocol:UDP
            Classtype:Potentially Bad Traffic
            Timestamp:192.168.2.38.8.8.853630532023883 06/23/22-18:01:13.124714
            SID:2023883
            Source Port:53630
            Destination Port:53
            Protocol:UDP
            Classtype:Potentially Bad Traffic
            Timestamp:192.168.2.38.8.8.858709532023883 06/23/22-18:03:43.028981
            SID:2023883
            Source Port:58709
            Destination Port:53
            Protocol:UDP
            Classtype:Potentially Bad Traffic
            Timestamp:192.168.2.38.8.8.851906532023883 06/23/22-18:02:43.008995
            SID:2023883
            Source Port:51906
            Destination Port:53
            Protocol:UDP
            Classtype:Potentially Bad Traffic
            Timestamp:192.168.2.38.8.8.858003532023883 06/23/22-18:04:13.049394
            SID:2023883
            Source Port:58003
            Destination Port:53
            Protocol:UDP
            Classtype:Potentially Bad Traffic
            Timestamp:192.168.2.38.8.8.857421532023883 06/23/22-18:00:13.228137
            SID:2023883
            Source Port:57421
            Destination Port:53
            Protocol:UDP
            Classtype:Potentially Bad Traffic
            Timestamp:192.168.2.38.8.8.856189532023883 06/23/22-18:00:43.017885
            SID:2023883
            Source Port:56189
            Destination Port:53
            Protocol:UDP
            Classtype:Potentially Bad Traffic
            Timestamp:192.168.2.38.8.8.852540532023883 06/23/22-18:02:13.036582
            SID:2023883
            Source Port:52540
            Destination Port:53
            Protocol:UDP
            Classtype:Potentially Bad Traffic
            Timestamp:192.168.2.38.8.8.863030532023883 06/23/22-18:03:13.066960
            SID:2023883
            Source Port:63030
            Destination Port:53
            Protocol:UDP
            Classtype:Potentially Bad Traffic

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: ikvNEF5d2Z.dllAvira: detected
            Source: ikvNEF5d2Z.dllVirustotal: Detection: 76%Perma Link
            Source: ikvNEF5d2Z.dllMetadefender: Detection: 35%Perma Link
            Source: ikvNEF5d2Z.dllReversingLabs: Detection: 65%
            Source: http://dsedertyhuiokle.top/doAvira URL Cloud: Label: malware
            Source: http://dsedertyhuiokle.top/topAvira URL Cloud: Label: malware
            Source: http://dsedertyhuiokle.top/CNAvira URL Cloud: Label: malware
            Source: http://dsedertyhuiokle.top/eQzAvira URL Cloud: Label: malware
            Source: http://dsedertyhuiokle.top/$lAvira URL Cloud: Label: malware
            Source: http://dsedertyhuiokle.top/;Avira URL Cloud: Label: malware
            Source: http://dsedertyhuiokle.top/?Avira URL Cloud: Label: malware
            Source: http://dsedertyhuiokle.top:80/&jAvira URL Cloud: Label: malware
            Source: http://dsedertyhuiokle.top/3Avira URL Cloud: Label: malware
            Source: http://dsedertyhuiokle.top/7Avira URL Cloud: Label: malware
            Source: http://dsedertyhuiokle.top:80/jYAvira URL Cloud: Label: malware
            Source: http://dsedertyhuiokle.top/Avira URL Cloud: Label: malware
            Source: http://dsedertyhuiokle.top/H2azAvira URL Cloud: Label: malware
            Source: http://dsedertyhuiokle.top/NameAvira URL Cloud: Label: malware
            Source: http://dsedertyhuiokle.top/Po3Avira URL Cloud: Label: malware
            Source: http://dsedertyhuiokle.top/sopAvira URL Cloud: Label: malware
            Source: dsedertyhuiokle.topVirustotal: Detection: 12%Perma Link
            Source: Yara matchFile source: 00000002.00000003.321553577.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.267642045.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.274029943.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.261454717.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.269643903.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.297404495.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.292337146.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.277053411.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.269043278.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.396642532.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.264700847.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000003.280507761.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.267145571.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.298272650.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.311756165.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000003.265795087.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000003.264618023.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.319014674.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.295125426.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.314754724.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000003.270691540.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.270084280.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000003.273346326.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.317474031.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.304327995.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.266413828.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000003.269326182.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.305135210.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.261968567.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.320094818.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.271220559.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.265620836.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000003.305936677.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000003.276312756.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.293963524.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.309363516.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000003.262421311.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.411869520.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.265218608.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000003.261647380.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.302975794.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.273106192.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.282267699.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000003.287602431.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.275791438.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.262765450.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000003.268258493.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.263740751.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.299841707.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.351326851.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.265359115.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.271492952.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.262406305.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.278543970.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.407235069.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.262811825.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.437622717.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.293411402.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.491241630.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.265793313.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.719810116.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.280994457.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.297638852.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.415117148.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.416746789.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.298094562.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.268018419.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000003.278246832.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.264969343.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.272087960.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.307033359.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.270822392.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.317906358.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000003.267338480.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.263723615.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.267270096.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.272354753.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000003.272644834.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.312571750.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.290176337.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000003.291011198.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.454332371.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.267942385.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.299224080.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.306791775.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.274845604.000001599AEC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.295599262.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.263807736.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000003.292690922.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000003.272047247.000001E90C7C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.274007377.000000000119D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: loaddll64.exe PID: 6552, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: regsvr32.exe PID: 6576, type: MEMORYSTR