Analysis

  • max time kernel
    138s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/08/2023, 18:55

General

  • Target

    943bc976ab76ee9b1e602decfadc0a2a_icedid_JC.exe

  • Size

    261KB

  • MD5

    943bc976ab76ee9b1e602decfadc0a2a

  • SHA1

    6d51edb3a5b91a8dafbf2aa2ac9748cf5a34cd44

  • SHA256

    49caa705232a5404c985bdec5d92dd1ac6647a031e4664d5c18fe15e497630bf

  • SHA512

    6e89f61dd229ab1e588116c0c2e47d39c55913433a0635fea0c1f9a8c903fd3d42b79c9d7732f2cd20b4c9d4335bdbb94bc40e5a9642c85fb4fb264f94ac5c80

  • SSDEEP

    3072:lxUm75Fku3eKeJk21ZSJReOqlz+mErj+HyHnNVIPL/+ybbiGF+1u46Q7q303lU8O:fU8DkpP1oJ1qlzUWUNVIT/bbbIW09R

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\943bc976ab76ee9b1e602decfadc0a2a_icedid_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\943bc976ab76ee9b1e602decfadc0a2a_icedid_JC.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Program Files\code\verify.exe
      "C:\Program Files\code\verify.exe" "33201"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\code\verify.exe

    Filesize

    261KB

    MD5

    4bce72d2a0df966fc87dad8f8864b931

    SHA1

    da41079cfe65eefa1de2a6294c9139ef5626307a

    SHA256

    829e835e538c351f6d785fc1ac81a77b54054c65949e1164dcf5205871ac8ab9

    SHA512

    5c7c8a36232f59e9396ddcdddc8f209922af4d8672b4c21e7774e0e92757a4b7777d5665354cf553b2857fdda21304259514395a65e540c22317537d88998e6a

  • C:\Program Files\code\verify.exe

    Filesize

    261KB

    MD5

    4bce72d2a0df966fc87dad8f8864b931

    SHA1

    da41079cfe65eefa1de2a6294c9139ef5626307a

    SHA256

    829e835e538c351f6d785fc1ac81a77b54054c65949e1164dcf5205871ac8ab9

    SHA512

    5c7c8a36232f59e9396ddcdddc8f209922af4d8672b4c21e7774e0e92757a4b7777d5665354cf553b2857fdda21304259514395a65e540c22317537d88998e6a