Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
05-08-2023 13:31
General
-
Target
72242a2ceac1573f23a34cb4e0cd6d69_backswap_icedid_JC.exe
-
Size
2.6MB
-
MD5
72242a2ceac1573f23a34cb4e0cd6d69
-
SHA1
137dec2d6b87a76affd3e7a359d37bd191f63d81
-
SHA256
61b5303feb469223d5a3891c190e9b0e49786cc59408074e8f5e0ea6101ba257
-
SHA512
da8117ca7e9290af8f177e126ff8a6b802d4ba65e110533ee6a084a962cc3c182deb8b10b34b06743ef1b685d75f2d368d3f63a2aa8e533b4478d92bfbccb46a
-
SSDEEP
24576:5nWYXDaHMv6CorjqnyPQGzh0JONZejOuC+e4mOzrvxiI3ENyesg/jHLxQVIxX6LP:tl1vqjdPQRw/D4mizA0dizLrB51vG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NTFS ADS 3 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\72242a2ceac1573f23a34cb4e0cd6d69_backswap_icedid_JC.exe"C:\Users\Admin\AppData\Local\Temp\72242a2ceac1573f23a34cb4e0cd6d69_backswap_icedid_JC.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe"C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 C:\WINDOWS\Media\ActiveX.ocx /s2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
642KB
MD5d871f2c4088b8b4044a06352378e5f47
SHA11ac52a4fa15aaee20307c475ff0ef95351418074
SHA256bfc4f31183a35555e19d2095a743129b20949acbcb5ea43a5fbfaa0b7e624bfa
SHA512294a0cc0d8f89b077821ed97891dc693bdb6dd3f7b4436840f78e5663ece817cf6400d782f31ae33b8fdbbffa9c1691e2411fc9240d2100c2c1e2a4be71b2d68
-
Filesize
642KB
MD5d871f2c4088b8b4044a06352378e5f47
SHA11ac52a4fa15aaee20307c475ff0ef95351418074
SHA256bfc4f31183a35555e19d2095a743129b20949acbcb5ea43a5fbfaa0b7e624bfa
SHA512294a0cc0d8f89b077821ed97891dc693bdb6dd3f7b4436840f78e5663ece817cf6400d782f31ae33b8fdbbffa9c1691e2411fc9240d2100c2c1e2a4be71b2d68
-
Filesize
12B
MD5b2829a04ff15ee0c32aa9ba622af3d3e
SHA1023a9fb549d99695f42f34717b4e8b1fbc7b3d20
SHA2561c6ee63139fded253fde5baf194e713d7440ac26c652153082f214bef2708244
SHA512feff9f38f838e691e3fa7f63d38dbdb98d1eb2a7c2d402f5a0fd2aa37066491b51c240c999148650edbfc798466cc0107c59e401d2411606d4a71b5af650807b