a27f4ad50c73317385acf600d040f1390e331d333c30c8497c299dce75bb9b27

Analysis

max time kernel
126s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2023 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45fc48a493d0a46357a9024af687e71d_icedid_JC.exe
Size

3.8MB
MD5

45fc48a493d0a46357a9024af687e71d
SHA1

d8a03ff245899fc484fd7b44c7e27275970c6942
SHA256

a27f4ad50c73317385acf600d040f1390e331d333c30c8497c299dce75bb9b27
SHA512

e935462da4b89785a744d88cfca895ed04c168ef9c457dd3bef6ff362f7076a23e7cb15d419086f49b25ae9b2d04c76d38141952e92bffd8b728002558e4df06
SSDEEP

98304:VGoOFhhiZ+SIoXib3pKfi7cM+GGAi/hX/Z66z24VZb:VA6pSTKGGAcZZ66z24VZb

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4896	45fc48a493d0a46357a9024af687e71d_icedid_JC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sdfxd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\45fc48a493d0a46357a9024af687e71d_icedid_JC.exe"	45fc48a493d0a46357a9024af687e71d_icedid_JC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4896	45fc48a493d0a46357a9024af687e71d_icedid_JC.exe
4896	45fc48a493d0a46357a9024af687e71d_icedid_JC.exe

C:\Users\Admin\AppData\Local\Temp\45fc48a493d0a46357a9024af687e71d_icedid_JC.exe
"C:\Users\Admin\AppData\Local\Temp\45fc48a493d0a46357a9024af687e71d_icedid_JC.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HPSocket4C.dll

Filesize
2.8MB

MD5
8430b540f961d9268b004929931aeb8c

SHA1
b306b1421b25ea019abd0fd849b64fdadf5bbd01

SHA256
33d2dfd87f6520428f7c24bcb64032be2cf97ecadcf2ee5530ca21a5d213be51

SHA512
da6fda11b945504eb388e2314d318c795eb5317898c80f367d876a32349b210c2471bf16259044bbe60fccd99334b719aaac5fe67698cb8a305b91f5f8d9ad4d

Download Submit
memory/4896-133-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads