Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
30/09/2023, 17:14
General
-
Target
2023-08-26_e7c342abaeba7f28d17327286384b32f_icedid_JC.exe
-
Size
3.6MB
-
MD5
e7c342abaeba7f28d17327286384b32f
-
SHA1
c8ead79e744a66d6f0fc4443d63c81c1f60f716a
-
SHA256
2d74d98016286e532342882252c47ebce66b4adf6f8a291e262f439269021e08
-
SHA512
e01273997f7ac46806e856505979ba0b2a54225f90c5820accb5075ff0f81256a07c4a3c20b82e8564ac10b46572cb4f6971caf4298d213ab563e5d1d1b45f94
-
SSDEEP
49152:y7Otfgl4Lxh89+J8djJXyFJgvCLzzi8y8i2Eb:WgG4Lxh89+JWJCFivCLzzi6if
Malware Config
Signatures
-
UPX packed file 54 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-26_e7c342abaeba7f28d17327286384b32f_icedid_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-26_e7c342abaeba7f28d17327286384b32f_icedid_JC.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2023-08-26_e7c342abaeba7f28d17327286384b32f_icedid_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-26_e7c342abaeba7f28d17327286384b32f_icedid_JC.exe" 10322122⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
Filesize
813KB
MD55e0db2d8b2750543cd2ebb9ea8e6cdd3
SHA18b997b38e179cd03c0a2e87bddbc1ebca39a8630
SHA25601eb95fa3943cf3c6b1a21e473a5c3cb9fcbce46913b15c96cac14e4f04075b4
SHA51238a2064f7a740feb6dba46d57998140f16da7b9302bfe217a24d593220c2340f854645d05993aac6b7ecf819b5c09e062c5c81ba29f79d919ae518e6de071716
-
Filesize
304KB
MD5d6d3ad7bf1d6f6ce9547613ed5e170a2
SHA16a20fe18619dc46e379c42f12ed761749053cbf9
SHA256ea3bd7fec193a8cfe1d5736301acadc476fb6aac5475a45776d0a638e9845445
SHA5122b900118d582eb8bba1612c67909bda97b2cd8755a00de1135c2809ab65385523a2f1c74eff7b37fc4ada585decfab2febbab9247d46038787a9ac786747c222
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
44KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
44KB