Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2023, 14:06
Static task
static1
Behavioral task
behavioral1
Sample
93bcdb9d575a6b961f408530ae32eeca_icedid_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
93bcdb9d575a6b961f408530ae32eeca_icedid_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
93bcdb9d575a6b961f408530ae32eeca_icedid_JC.exe
-
Size
412KB
-
MD5
93bcdb9d575a6b961f408530ae32eeca
-
SHA1
0bfcf86819cde43c80617ed3990f8f3e668b59c9
-
SHA256
b232b5795f2c9fc5ab26b4e310a24aef3ccbebc4ab37b135398b50822b71dbe2
-
SHA512
8e5af5673d52a1265fbd9c464619890e2858a225cbabe802a5320541385e15c01a74b1789ba5f2825f444ceafa3e281d443c9cccf5c92ddfccbcc64fcf4975f1
-
SSDEEP
12288:VplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:HxRQ+Fucuvm0as
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3040 DirectSetup.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\with\DirectSetup.exe 93bcdb9d575a6b961f408530ae32eeca_icedid_JC.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2112 93bcdb9d575a6b961f408530ae32eeca_icedid_JC.exe 2112 93bcdb9d575a6b961f408530ae32eeca_icedid_JC.exe 2112 93bcdb9d575a6b961f408530ae32eeca_icedid_JC.exe 2112 93bcdb9d575a6b961f408530ae32eeca_icedid_JC.exe 3040 DirectSetup.exe 3040 DirectSetup.exe 3040 DirectSetup.exe 3040 DirectSetup.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2112 wrote to memory of 3040 2112 93bcdb9d575a6b961f408530ae32eeca_icedid_JC.exe 83 PID 2112 wrote to memory of 3040 2112 93bcdb9d575a6b961f408530ae32eeca_icedid_JC.exe 83 PID 2112 wrote to memory of 3040 2112 93bcdb9d575a6b961f408530ae32eeca_icedid_JC.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\93bcdb9d575a6b961f408530ae32eeca_icedid_JC.exe"C:\Users\Admin\AppData\Local\Temp\93bcdb9d575a6b961f408530ae32eeca_icedid_JC.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files\with\DirectSetup.exe"C:\Program Files\with\DirectSetup.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3040
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
412KB
MD5af68d0b62f76506f4d252c35d8abd53b
SHA164d9dafd39f75317a25db24b829a7da876c715ee
SHA2566cac5b83195ce830bc4516c7e9fbd1e508a13487ca8b19e963fd2af75724c3ef
SHA5122443d3ab262ce630ff0d2613d1e787988cb4025502a133fbffe6ea4ab664ebf18717d85bc17467a9d108214cbbb692805cab49d58fda50df862de90ba399a04a
-
Filesize
412KB
MD5af68d0b62f76506f4d252c35d8abd53b
SHA164d9dafd39f75317a25db24b829a7da876c715ee
SHA2566cac5b83195ce830bc4516c7e9fbd1e508a13487ca8b19e963fd2af75724c3ef
SHA5122443d3ab262ce630ff0d2613d1e787988cb4025502a133fbffe6ea4ab664ebf18717d85bc17467a9d108214cbbb692805cab49d58fda50df862de90ba399a04a