Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
06/08/2023, 15:40
General
-
Target
8cbf890575e594d7900f873e9366ab4c_hacktools_icedid_JC.exe
-
Size
2.5MB
-
MD5
8cbf890575e594d7900f873e9366ab4c
-
SHA1
144fdf596dfb89018cf220c6f39293cb4afa81b6
-
SHA256
9701949f6feff9efc4f5ffb49ec8da30711fd2daae2efcdc9b920323edb6c5ce
-
SHA512
a0c3dcf75f788553c48d68c36215b94f9a5706ed13f6a558ced83221b048cf3cb3b10e4d01abd5e4df6fb6f2ba778995e9e0e5a2a2204fe3dc57194f521c3b1e
-
SSDEEP
49152:XmvdgqxpQzgXQ3TooLeYN/yKiZ3pWBST1W5KiZY:IZpQzgXgkoLpN/yKO8OW5KOY
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cbf890575e594d7900f873e9366ab4c_hacktools_icedid_JC.exe"C:\Users\Admin\AppData\Local\Temp\8cbf890575e594d7900f873e9366ab4c_hacktools_icedid_JC.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RZFR.KWLGM"C:\Users\Admin\AppData\Local\Temp\RZFR.KWLGM"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh winsock reset3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD5c3adbb35a05b44bc877a895d273aa270
SHA18afe20d8261d217fd23ccfe53bd45ad3bec82d2d
SHA256b2b2ea9737587313d420bde96a42063c002a83e35d9f987f8ec0d5d4d96c262c
SHA512614dc24e3368047d68e2833ecdf9cda1f5ef290fc74287769a70df46bfa937386ce2e1332b3bada0f7e54b470ecdfe7c8bbd4ec3fa1c815f52993bb7edb93afc
-
Filesize
120KB
MD5c3adbb35a05b44bc877a895d273aa270
SHA18afe20d8261d217fd23ccfe53bd45ad3bec82d2d
SHA256b2b2ea9737587313d420bde96a42063c002a83e35d9f987f8ec0d5d4d96c262c
SHA512614dc24e3368047d68e2833ecdf9cda1f5ef290fc74287769a70df46bfa937386ce2e1332b3bada0f7e54b470ecdfe7c8bbd4ec3fa1c815f52993bb7edb93afc
-
Filesize
2.5MB
MD504cfe79147260a2593d9858923aa44e6
SHA1857c21980b1c847a419f8fa3e3b2c52bde95390f
SHA25691784a417d2cd39cfb55cc91282903a90ebb93bc0cd82c6b6f8032a05640e6dd
SHA512cd0eec8b19207474643e0505bbf534bb0b239e6bd081a9f84d1a767b79b965b9e41f23ad0140a1f5133908192e591ceedee79c60cebc2e0159c36042d649549f
-
Filesize
2.5MB
MD504cfe79147260a2593d9858923aa44e6
SHA1857c21980b1c847a419f8fa3e3b2c52bde95390f
SHA25691784a417d2cd39cfb55cc91282903a90ebb93bc0cd82c6b6f8032a05640e6dd
SHA512cd0eec8b19207474643e0505bbf534bb0b239e6bd081a9f84d1a767b79b965b9e41f23ad0140a1f5133908192e591ceedee79c60cebc2e0159c36042d649549f
-
Filesize
120KB
MD5c3adbb35a05b44bc877a895d273aa270
SHA18afe20d8261d217fd23ccfe53bd45ad3bec82d2d
SHA256b2b2ea9737587313d420bde96a42063c002a83e35d9f987f8ec0d5d4d96c262c
SHA512614dc24e3368047d68e2833ecdf9cda1f5ef290fc74287769a70df46bfa937386ce2e1332b3bada0f7e54b470ecdfe7c8bbd4ec3fa1c815f52993bb7edb93afc
-
Filesize
52KB
MD5b60da4e2e5aceba3ce3d87ee2cd872ee
SHA19bbdbf1f3ce2c000a86e0473da756a4b1031db41
SHA256b581fcc82c0462d60286a80912ab2ce5aca7d7b11c5cff0b5f74716dbb7dc453
SHA512664d6f893484252b339ff8f413a4cf9da9b0ef82ed74b097ba86a5f00b4d9740eef6e8a5b81e8be7e82ae4009928097baf15e65a03f31c4b92e44f593ce39874
-
Filesize
52KB
MD5b60da4e2e5aceba3ce3d87ee2cd872ee
SHA19bbdbf1f3ce2c000a86e0473da756a4b1031db41
SHA256b581fcc82c0462d60286a80912ab2ce5aca7d7b11c5cff0b5f74716dbb7dc453
SHA512664d6f893484252b339ff8f413a4cf9da9b0ef82ed74b097ba86a5f00b4d9740eef6e8a5b81e8be7e82ae4009928097baf15e65a03f31c4b92e44f593ce39874
-
Filesize
52KB
MD5b60da4e2e5aceba3ce3d87ee2cd872ee
SHA19bbdbf1f3ce2c000a86e0473da756a4b1031db41
SHA256b581fcc82c0462d60286a80912ab2ce5aca7d7b11c5cff0b5f74716dbb7dc453
SHA512664d6f893484252b339ff8f413a4cf9da9b0ef82ed74b097ba86a5f00b4d9740eef6e8a5b81e8be7e82ae4009928097baf15e65a03f31c4b92e44f593ce39874
-
Filesize
56KB