1507c81b2f0fd17fe06c624d54b927b8fc096e8f387b834aee08722d56466ad8

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
05/08/2023, 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

693bff28e326c6cbe622386bf3842513_icedid_JC.exe
Size

367KB
MD5

693bff28e326c6cbe622386bf3842513
SHA1

d1bc792fa87b2c37f5f6883eeb7e63ef6aa8a07b
SHA256

1507c81b2f0fd17fe06c624d54b927b8fc096e8f387b834aee08722d56466ad8
SHA512

538c839d60815e98446eb062f1f97937d1233aaefd1c9cb993231384cd0f813de05d548dcba2f470a1ae17c79579f1899da9ef14af1d7686e49ac0e5b815b675
SSDEEP

6144:xplrlbbDdQaqd2X/96fr3KFEUGjr8uB2WgcA0cpXEVNrvGZ4FUqm6:xplrVbDdQaqdS/ofraFErH8uB2Wm0SXj

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2452	Autorun.exe

Loads dropped DLL 2 IoCs

pid	Process
2332	693bff28e326c6cbe622386bf3842513_icedid_JC.exe
2332	693bff28e326c6cbe622386bf3842513_icedid_JC.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Panel\Autorun.exe	693bff28e326c6cbe622386bf3842513_icedid_JC.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2332	693bff28e326c6cbe622386bf3842513_icedid_JC.exe
2332	693bff28e326c6cbe622386bf3842513_icedid_JC.exe
2332	693bff28e326c6cbe622386bf3842513_icedid_JC.exe
2332	693bff28e326c6cbe622386bf3842513_icedid_JC.exe
2452	Autorun.exe
2452	Autorun.exe
2452	Autorun.exe
2452	Autorun.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2452	2332	693bff28e326c6cbe622386bf3842513_icedid_JC.exe	28
PID 2332 wrote to memory of 2452	2332	693bff28e326c6cbe622386bf3842513_icedid_JC.exe	28
PID 2332 wrote to memory of 2452	2332	693bff28e326c6cbe622386bf3842513_icedid_JC.exe	28
PID 2332 wrote to memory of 2452	2332	693bff28e326c6cbe622386bf3842513_icedid_JC.exe	28
PID 2332 wrote to memory of 2452	2332	693bff28e326c6cbe622386bf3842513_icedid_JC.exe	28
PID 2332 wrote to memory of 2452	2332	693bff28e326c6cbe622386bf3842513_icedid_JC.exe	28
PID 2332 wrote to memory of 2452	2332	693bff28e326c6cbe622386bf3842513_icedid_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\693bff28e326c6cbe622386bf3842513_icedid_JC.exe
"C:\Users\Admin\AppData\Local\Temp\693bff28e326c6cbe622386bf3842513_icedid_JC.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files\Panel\Autorun.exe
  "C:\Program Files\Panel\Autorun.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Panel\Autorun.exe

Filesize
367KB

MD5
a85eaee6c2bb24c741a70eb63b978eee

SHA1
32bcf4e91bcbb2b01b8d176ffaafcdf1f15343f4

SHA256
c14b91ebf78295003be274972ef69b2d39422462046ffa4db41e729a1f65ed47

SHA512
5c70bc373d0f251feddf0bb81b9b41d7bd55a9a26cf8570e953019c21eb18c2395dfe5336ec82d01fefee3ace12d9b3f199fcfbafd1196de31edc117f8bbef96

Download Submit
C:\Program Files\Panel\Autorun.exe

Filesize
367KB

MD5
a85eaee6c2bb24c741a70eb63b978eee

SHA1
32bcf4e91bcbb2b01b8d176ffaafcdf1f15343f4

SHA256
c14b91ebf78295003be274972ef69b2d39422462046ffa4db41e729a1f65ed47

SHA512
5c70bc373d0f251feddf0bb81b9b41d7bd55a9a26cf8570e953019c21eb18c2395dfe5336ec82d01fefee3ace12d9b3f199fcfbafd1196de31edc117f8bbef96

Download Submit
C:\Program Files\Panel\Autorun.exe

Filesize
367KB

MD5
a85eaee6c2bb24c741a70eb63b978eee

SHA1
32bcf4e91bcbb2b01b8d176ffaafcdf1f15343f4

SHA256
c14b91ebf78295003be274972ef69b2d39422462046ffa4db41e729a1f65ed47

SHA512
5c70bc373d0f251feddf0bb81b9b41d7bd55a9a26cf8570e953019c21eb18c2395dfe5336ec82d01fefee3ace12d9b3f199fcfbafd1196de31edc117f8bbef96

Download Submit
\Program Files\Panel\Autorun.exe

Filesize
367KB

MD5
a85eaee6c2bb24c741a70eb63b978eee

SHA1
32bcf4e91bcbb2b01b8d176ffaafcdf1f15343f4

SHA256
c14b91ebf78295003be274972ef69b2d39422462046ffa4db41e729a1f65ed47

SHA512
5c70bc373d0f251feddf0bb81b9b41d7bd55a9a26cf8570e953019c21eb18c2395dfe5336ec82d01fefee3ace12d9b3f199fcfbafd1196de31edc117f8bbef96

Download Submit
\Program Files\Panel\Autorun.exe

Filesize
367KB

MD5
a85eaee6c2bb24c741a70eb63b978eee

SHA1
32bcf4e91bcbb2b01b8d176ffaafcdf1f15343f4

SHA256
c14b91ebf78295003be274972ef69b2d39422462046ffa4db41e729a1f65ed47

SHA512
5c70bc373d0f251feddf0bb81b9b41d7bd55a9a26cf8570e953019c21eb18c2395dfe5336ec82d01fefee3ace12d9b3f199fcfbafd1196de31edc117f8bbef96

Download Submit