Analysis

  • max time kernel
    140s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-08-2023 17:37

General

  • Target

    6ebbe986e2c6086e4d7fd68ea2343fd6_icedid_JC.exe

  • Size

    372KB

  • MD5

    6ebbe986e2c6086e4d7fd68ea2343fd6

  • SHA1

    800af979fc0dd0dbb7d9f34d315bf6d7b49343a4

  • SHA256

    a664afb02bbbbea237cf6254f3b641a7bd34caefd9463a330771c61c37457817

  • SHA512

    16237810ae100df642a6849e94b0a404f024a532db62e079e38523118dc17af847f34d88b0ec138df117b4a7d1af9147ce69fd371e6c1dfe61abcef86ecf7970

  • SSDEEP

    6144:OplrlbbDdQaqd2X/96fr3KFEUGjr8uB2WgcA0cpXEVNrvGZ4FUqm6:OplrVbDdQaqdS/ofraFErH8uB2Wm0SXj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ebbe986e2c6086e4d7fd68ea2343fd6_icedid_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\6ebbe986e2c6086e4d7fd68ea2343fd6_icedid_JC.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Program Files\development\appropriate.exe
      "C:\Program Files\development\appropriate.exe" "33201"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\development\appropriate.exe

    Filesize

    372KB

    MD5

    f5ca8617e90ac03b62ba9ea1e65c9c0b

    SHA1

    ff39519ccb3d4bca828577db8e79f6f7e48b262a

    SHA256

    5c6975222c9c7c23794b3c513d9e0c505718e2fd3055259be21393e72620740b

    SHA512

    f26edb152c3b96c3a1f335813d8596638d5571f7a7d38af9e8f5a24cb335c68a272c418f8bbd23c9d06f36b5b8717b7553ea1bfdc7002c9457883bd23cbb4274

  • C:\Program Files\development\appropriate.exe

    Filesize

    372KB

    MD5

    f5ca8617e90ac03b62ba9ea1e65c9c0b

    SHA1

    ff39519ccb3d4bca828577db8e79f6f7e48b262a

    SHA256

    5c6975222c9c7c23794b3c513d9e0c505718e2fd3055259be21393e72620740b

    SHA512

    f26edb152c3b96c3a1f335813d8596638d5571f7a7d38af9e8f5a24cb335c68a272c418f8bbd23c9d06f36b5b8717b7553ea1bfdc7002c9457883bd23cbb4274