General
-
Target
Setup_Win_03-01-2023_08-37-05.zip
-
Size
458KB
-
Sample
230103-lwmnaaec4v
-
MD5
18005e5d8eb99c5ed665e9a6ff740ddd
-
SHA1
a6d34aebe9380dda07bdec982ae02c55fb0fafbe
-
SHA256
30fc78d96fc1814753b38958207e80727e9fd9b016ab951c93a3ddddfc643731
-
SHA512
085d6297d2f89f46c214ed2862863b2c82b5671a47a9ebc517684de22de66231d49ef2dfff8158fd101b6acc1344dff412b0dc12f13f5963a631376e60dfda0c
-
SSDEEP
12288:8XV0sQguUTPlwQ4ZqUZZfIht/OaqL6NuhXcW3YcU8eY4q:8X5QguUzlwQlIut/gL6NaXnYcU8mq
Static task
static1
Behavioral task
behavioral1
Sample
Setup_Win_03-01-2023_08-37-05.msi
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Setup_Win_03-01-2023_08-37-05.msi
Resource
win10v2004-20220812-en
Malware Config
Extracted
icedid
2957048208
whothitheka.com
Targets
-
-
Target
Setup_Win_03-01-2023_08-37-05.msi
-
Size
772KB
-
MD5
f2d5895a8e66ef63e687e356dac665cf
-
SHA1
d5ec3af492980df0bcbca26ceb864177978ef69d
-
SHA256
6b4239bdb1080b21570feba7058d87b35e18bc74c20c68611c2012002b8a0aa3
-
SHA512
d1ff00a258a811f395e91dcca6a22e8dd839aef606f74d2ef78391e01d4ce13d490903b6d9378c114ba0f880cb698d76027e62e3832ea1a97fe4ba8cfb4bb1a8
-
SSDEEP
12288:GwHL0DpPMX/wg4ZqU0UmmhtNOOdpxoPcrDnS34y9RPF8L:vHL02vwglMtNjjoGS3bRPF8L
Score10/10-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-