Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2023, 15:40
Static task
static1
Behavioral task
behavioral1
Sample
8cbf890575e594d7900f873e9366ab4c_hacktools_icedid_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
8cbf890575e594d7900f873e9366ab4c_hacktools_icedid_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
8cbf890575e594d7900f873e9366ab4c_hacktools_icedid_JC.exe
-
Size
2.5MB
-
MD5
8cbf890575e594d7900f873e9366ab4c
-
SHA1
144fdf596dfb89018cf220c6f39293cb4afa81b6
-
SHA256
9701949f6feff9efc4f5ffb49ec8da30711fd2daae2efcdc9b920323edb6c5ce
-
SHA512
a0c3dcf75f788553c48d68c36215b94f9a5706ed13f6a558ced83221b048cf3cb3b10e4d01abd5e4df6fb6f2ba778995e9e0e5a2a2204fe3dc57194f521c3b1e
-
SSDEEP
49152:XmvdgqxpQzgXQ3TooLeYN/yKiZ3pWBST1W5KiZY:IZpQzgXgkoLpN/yKO8OW5KOY
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3332 RZFR.KWLGM -
Loads dropped DLL 4 IoCs
pid Process 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\shurufa.ime RZFR.KWLGM File created C:\Windows\SysWOW64\ESPI11.dll RZFR.KWLGM File opened for modification C:\Windows\SysWOW64\ESPI11.dll RZFR.KWLGM File created C:\Windows\SysWOW64\fuzhu.dll RZFR.KWLGM -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM 3332 RZFR.KWLGM -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4760 8cbf890575e594d7900f873e9366ab4c_hacktools_icedid_JC.exe 4760 8cbf890575e594d7900f873e9366ab4c_hacktools_icedid_JC.exe 3332 RZFR.KWLGM 3332 RZFR.KWLGM -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4760 wrote to memory of 3332 4760 8cbf890575e594d7900f873e9366ab4c_hacktools_icedid_JC.exe 80 PID 4760 wrote to memory of 3332 4760 8cbf890575e594d7900f873e9366ab4c_hacktools_icedid_JC.exe 80 PID 4760 wrote to memory of 3332 4760 8cbf890575e594d7900f873e9366ab4c_hacktools_icedid_JC.exe 80 PID 3332 wrote to memory of 4664 3332 RZFR.KWLGM 84 PID 3332 wrote to memory of 4664 3332 RZFR.KWLGM 84 PID 3332 wrote to memory of 4664 3332 RZFR.KWLGM 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cbf890575e594d7900f873e9366ab4c_hacktools_icedid_JC.exe"C:\Users\Admin\AppData\Local\Temp\8cbf890575e594d7900f873e9366ab4c_hacktools_icedid_JC.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\RZFR.KWLGM"C:\Users\Admin\AppData\Local\Temp\RZFR.KWLGM"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\netsh.exenetsh winsock reset3⤵PID:4664
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD5c3adbb35a05b44bc877a895d273aa270
SHA18afe20d8261d217fd23ccfe53bd45ad3bec82d2d
SHA256b2b2ea9737587313d420bde96a42063c002a83e35d9f987f8ec0d5d4d96c262c
SHA512614dc24e3368047d68e2833ecdf9cda1f5ef290fc74287769a70df46bfa937386ce2e1332b3bada0f7e54b470ecdfe7c8bbd4ec3fa1c815f52993bb7edb93afc
-
Filesize
120KB
MD5c3adbb35a05b44bc877a895d273aa270
SHA18afe20d8261d217fd23ccfe53bd45ad3bec82d2d
SHA256b2b2ea9737587313d420bde96a42063c002a83e35d9f987f8ec0d5d4d96c262c
SHA512614dc24e3368047d68e2833ecdf9cda1f5ef290fc74287769a70df46bfa937386ce2e1332b3bada0f7e54b470ecdfe7c8bbd4ec3fa1c815f52993bb7edb93afc
-
Filesize
2.5MB
MD504cfe79147260a2593d9858923aa44e6
SHA1857c21980b1c847a419f8fa3e3b2c52bde95390f
SHA25691784a417d2cd39cfb55cc91282903a90ebb93bc0cd82c6b6f8032a05640e6dd
SHA512cd0eec8b19207474643e0505bbf534bb0b239e6bd081a9f84d1a767b79b965b9e41f23ad0140a1f5133908192e591ceedee79c60cebc2e0159c36042d649549f
-
Filesize
2.5MB
MD504cfe79147260a2593d9858923aa44e6
SHA1857c21980b1c847a419f8fa3e3b2c52bde95390f
SHA25691784a417d2cd39cfb55cc91282903a90ebb93bc0cd82c6b6f8032a05640e6dd
SHA512cd0eec8b19207474643e0505bbf534bb0b239e6bd081a9f84d1a767b79b965b9e41f23ad0140a1f5133908192e591ceedee79c60cebc2e0159c36042d649549f
-
Filesize
120KB
MD5c3adbb35a05b44bc877a895d273aa270
SHA18afe20d8261d217fd23ccfe53bd45ad3bec82d2d
SHA256b2b2ea9737587313d420bde96a42063c002a83e35d9f987f8ec0d5d4d96c262c
SHA512614dc24e3368047d68e2833ecdf9cda1f5ef290fc74287769a70df46bfa937386ce2e1332b3bada0f7e54b470ecdfe7c8bbd4ec3fa1c815f52993bb7edb93afc
-
Filesize
52KB
MD5b60da4e2e5aceba3ce3d87ee2cd872ee
SHA19bbdbf1f3ce2c000a86e0473da756a4b1031db41
SHA256b581fcc82c0462d60286a80912ab2ce5aca7d7b11c5cff0b5f74716dbb7dc453
SHA512664d6f893484252b339ff8f413a4cf9da9b0ef82ed74b097ba86a5f00b4d9740eef6e8a5b81e8be7e82ae4009928097baf15e65a03f31c4b92e44f593ce39874
-
Filesize
52KB
MD5b60da4e2e5aceba3ce3d87ee2cd872ee
SHA19bbdbf1f3ce2c000a86e0473da756a4b1031db41
SHA256b581fcc82c0462d60286a80912ab2ce5aca7d7b11c5cff0b5f74716dbb7dc453
SHA512664d6f893484252b339ff8f413a4cf9da9b0ef82ed74b097ba86a5f00b4d9740eef6e8a5b81e8be7e82ae4009928097baf15e65a03f31c4b92e44f593ce39874
-
Filesize
52KB
MD5b60da4e2e5aceba3ce3d87ee2cd872ee
SHA19bbdbf1f3ce2c000a86e0473da756a4b1031db41
SHA256b581fcc82c0462d60286a80912ab2ce5aca7d7b11c5cff0b5f74716dbb7dc453
SHA512664d6f893484252b339ff8f413a4cf9da9b0ef82ed74b097ba86a5f00b4d9740eef6e8a5b81e8be7e82ae4009928097baf15e65a03f31c4b92e44f593ce39874