5bcee7a1f1ec92cc4b457e8e4045383d317df1fa97b7371d16038d19ff318fed

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16/08/2023, 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

094a255627e9828ac878242cea16eaa9_icedid_JC.exe
Size

412KB
MD5

094a255627e9828ac878242cea16eaa9
SHA1

e1e32672730e5a0e7ac9674801482ceab4c8c4a4
SHA256

5bcee7a1f1ec92cc4b457e8e4045383d317df1fa97b7371d16038d19ff318fed
SHA512

c84fad52a5fbb39870250f2a502e2df81a8c78820b63c7a8bdc095cf598f79b063eb15c52088b27fb311e91a688442fd360ea1422305fdfcbab986f96c39aa47
SSDEEP

12288:CplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:OxRQ+Fucuvm0as

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2328	Applications.exe

Loads dropped DLL 2 IoCs

pid	Process
2292	094a255627e9828ac878242cea16eaa9_icedid_JC.exe
2292	094a255627e9828ac878242cea16eaa9_icedid_JC.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\DirectSetup\Applications.exe	094a255627e9828ac878242cea16eaa9_icedid_JC.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2292	094a255627e9828ac878242cea16eaa9_icedid_JC.exe
2292	094a255627e9828ac878242cea16eaa9_icedid_JC.exe
2292	094a255627e9828ac878242cea16eaa9_icedid_JC.exe
2292	094a255627e9828ac878242cea16eaa9_icedid_JC.exe
2328	Applications.exe
2328	Applications.exe
2328	Applications.exe
2328	Applications.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2328	2292	094a255627e9828ac878242cea16eaa9_icedid_JC.exe	28
PID 2292 wrote to memory of 2328	2292	094a255627e9828ac878242cea16eaa9_icedid_JC.exe	28
PID 2292 wrote to memory of 2328	2292	094a255627e9828ac878242cea16eaa9_icedid_JC.exe	28
PID 2292 wrote to memory of 2328	2292	094a255627e9828ac878242cea16eaa9_icedid_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\094a255627e9828ac878242cea16eaa9_icedid_JC.exe
"C:\Users\Admin\AppData\Local\Temp\094a255627e9828ac878242cea16eaa9_icedid_JC.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files\DirectSetup\Applications.exe
  "C:\Program Files\DirectSetup\Applications.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\DirectSetup\Applications.exe

Filesize
412KB

MD5
9ff8aec9787ca6e0f1c19ac8c8104b9d

SHA1
1b76756c612df7593011572b70cb13405871ea13

SHA256
221f209ebfcefcc42741b16f19d2de253ab6d53d971cbb1aaedb1e3f52216cfc

SHA512
f569dd2f527e029af4c3d26d9f57d1c11e55aca4f1ddcf9375d438c21c668f65f65bd2e0fa1f24d8f0f502f9e92d6fad20028a01181b58f8f1345944e9e2cc4b

Download Submit
C:\Program Files\DirectSetup\Applications.exe

Filesize
412KB

MD5
9ff8aec9787ca6e0f1c19ac8c8104b9d

SHA1
1b76756c612df7593011572b70cb13405871ea13

SHA256
221f209ebfcefcc42741b16f19d2de253ab6d53d971cbb1aaedb1e3f52216cfc

SHA512
f569dd2f527e029af4c3d26d9f57d1c11e55aca4f1ddcf9375d438c21c668f65f65bd2e0fa1f24d8f0f502f9e92d6fad20028a01181b58f8f1345944e9e2cc4b

Download Submit
\Program Files\DirectSetup\Applications.exe

Filesize
412KB

MD5
9ff8aec9787ca6e0f1c19ac8c8104b9d

SHA1
1b76756c612df7593011572b70cb13405871ea13

SHA256
221f209ebfcefcc42741b16f19d2de253ab6d53d971cbb1aaedb1e3f52216cfc

SHA512
f569dd2f527e029af4c3d26d9f57d1c11e55aca4f1ddcf9375d438c21c668f65f65bd2e0fa1f24d8f0f502f9e92d6fad20028a01181b58f8f1345944e9e2cc4b

Download Submit
\Program Files\DirectSetup\Applications.exe

Filesize
412KB

MD5
9ff8aec9787ca6e0f1c19ac8c8104b9d

SHA1
1b76756c612df7593011572b70cb13405871ea13

SHA256
221f209ebfcefcc42741b16f19d2de253ab6d53d971cbb1aaedb1e3f52216cfc

SHA512
f569dd2f527e029af4c3d26d9f57d1c11e55aca4f1ddcf9375d438c21c668f65f65bd2e0fa1f24d8f0f502f9e92d6fad20028a01181b58f8f1345944e9e2cc4b

Download Submit