Overview

overview

7

Static

static

3

2024-04-28...id.exe

windows7-x64

7

2024-04-28...id.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    141s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 10:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-28_bc98c095a804215bf82755355aded823_icedid.exe

  • Size

    284KB

  • MD5

    bc98c095a804215bf82755355aded823

  • SHA1

    e4445cf7416969eebb12a31d573baa990a8ecf04

  • SHA256

    45ef35da373b5dc185b9205b2cc56ee5b226bf99257867a66b4a14f58a48c438

  • SHA512

    6831a191dfff649e133007b030c2d419c60966560f9f2033c19234af8c402c21e0136b2aad1c6d5d798c2075f4b01563b712c90506fd0e5a11637b91be9def3f

  • SSDEEP

    6144:3lDx7mlcAZBcIdqkorDfoR/0C1fzDB9ePHSJ:3lDx7mlHZo7HoRv177ePH

Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-28_bc98c095a804215bf82755355aded823_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-28_bc98c095a804215bf82755355aded823_icedid.exe"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer start page
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3292
    • \??\c:\windows\system\sethome2953.exe
      c:\windows\system\sethome2953.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4416
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4476 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4944

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk
      Filesize

      1KB

      MD5

      7ea5e6af0fb75696345c6719e9a6006e

      SHA1

      5b79080d1c3527380bb4fb826e69863338c015bd

      SHA256

      64179ff03983ba466fbce8ad80ac1304ef024a700c0a06a590f083a898e631f1

      SHA512

      1cbc69fcbedcf317c8cc50d3f45ec28e3561af4e99a1371ece3ea1b9eaab86e7f983d723909b2e6b45c1ab0c16f9194b56693aca0363503ea1efbb83ef2d0ab8

      Download Submit
    • C:\Users\abc.lnk
      Filesize

      1KB

      MD5

      d8c84e3733720328313a3d5b4e1a5ef8

      SHA1

      1acf7e8c645bcdd2f8c72b2eb36d4edd9311bde8

      SHA256

      b82e03f3ec8cb03ff74e03637a15c25ee07ef26479403082238fb2f8d3abe04a

      SHA512

      aad16b23e44f7003107b937eb647e5d4e83adda7d3f1ddca47cfbacdb2008b28b287989fbd9788109ab62aa3ec77b550371d762e19d8bcfe78cdc91e81b2ce54

      Download Submit
    • \??\c:\windows\system\sethome2953.exe
      Filesize

      284KB

      MD5

      13a107fdb678cb23b804de43beaa1330

      SHA1

      543f1dba12393fe94f5ac0e317c3c8e40693121c

      SHA256

      4f0cbbeb80607296d6fb661b509e680aee10074d310f55634d63ebf4a64d2f42

      SHA512

      5ea19fc77746c0e180216bef2883fe35badb036e272be067a538fe3041752c75ad77dfd7b54674f318109f3b03cb2f9238fcdfa9e8f798e66f1b0bb5c1bfa468

      Download Submit