a27f4ad50c73317385acf600d040f1390e331d333c30c8497c299dce75bb9b27

Analysis

max time kernel
120s
max time network
142s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
02/08/2023, 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45fc48a493d0a46357a9024af687e71d_icedid_JC.exe
Size

3.8MB
MD5

45fc48a493d0a46357a9024af687e71d
SHA1

d8a03ff245899fc484fd7b44c7e27275970c6942
SHA256

a27f4ad50c73317385acf600d040f1390e331d333c30c8497c299dce75bb9b27
SHA512

e935462da4b89785a744d88cfca895ed04c168ef9c457dd3bef6ff362f7076a23e7cb15d419086f49b25ae9b2d04c76d38141952e92bffd8b728002558e4df06
SSDEEP

98304:VGoOFhhiZ+SIoXib3pKfi7cM+GGAi/hX/Z66z24VZb:VA6pSTKGGAcZZ66z24VZb

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2424	45fc48a493d0a46357a9024af687e71d_icedid_JC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sdfxd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\45fc48a493d0a46357a9024af687e71d_icedid_JC.exe"	45fc48a493d0a46357a9024af687e71d_icedid_JC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2424	45fc48a493d0a46357a9024af687e71d_icedid_JC.exe
2424	45fc48a493d0a46357a9024af687e71d_icedid_JC.exe

C:\Users\Admin\AppData\Local\Temp\45fc48a493d0a46357a9024af687e71d_icedid_JC.exe
"C:\Users\Admin\AppData\Local\Temp\45fc48a493d0a46357a9024af687e71d_icedid_JC.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\HPSocket4C.dll

Filesize
2.8MB

MD5
8430b540f961d9268b004929931aeb8c

SHA1
b306b1421b25ea019abd0fd849b64fdadf5bbd01

SHA256
33d2dfd87f6520428f7c24bcb64032be2cf97ecadcf2ee5530ca21a5d213be51

SHA512
da6fda11b945504eb388e2314d318c795eb5317898c80f367d876a32349b210c2471bf16259044bbe60fccd99334b719aaac5fe67698cb8a305b91f5f8d9ad4d

Download Submit
memory/2424-54-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads