Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
31/10/2023, 15:38
General
-
Target
NEAS.2023-09-05_c56a291cd9dcf54673775b8ab2392085_icedid_JC.exe
-
Size
366KB
-
MD5
c56a291cd9dcf54673775b8ab2392085
-
SHA1
3d4dfaf5a837e8a6ff6c431fdbf1892d7b07688b
-
SHA256
066451ea9a9edc7d5f6dbc0c257dc4e7df0a68e62d151bfd5697ee14ff03a4bf
-
SHA512
0d939c0f92d7d235bc1efc1470142cca3d4ddd62ff31b84bad7db5d18928680f08f83faa871055cc7183d120a3187de1efc544d146a31f42e2319968a4d58178
-
SSDEEP
6144:SplrlbbDdQaqd2X/96fr3KFEUGjr8uB2WgcA0cpXEVNrvGZ4FUqm6:SplrVbDdQaqdS/ofraFErH8uB2Wm0SXj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_c56a291cd9dcf54673775b8ab2392085_icedid_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_c56a291cd9dcf54673775b8ab2392085_icedid_JC.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\runtime\redistribution.exe"C:\Program Files\runtime\redistribution.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
366KB
MD52876f1089ba28b758ab6c117d2ea133b
SHA1d79397d3fd314d2a4192cf66198f054a3977a7a9
SHA2561cf0196aec811a0e9da7529355b9ca7f1645535c910642602bfcaf84cc089526
SHA5126872407c6bbc1117235997fbfa4237cc70cd5a2d8feb77c08d87993d21680d7b1c0cdff205ebc559aef78dd9fb8a6fdc73e756588240f92f739e0c4f98349248
-
Filesize
366KB
MD52876f1089ba28b758ab6c117d2ea133b
SHA1d79397d3fd314d2a4192cf66198f054a3977a7a9
SHA2561cf0196aec811a0e9da7529355b9ca7f1645535c910642602bfcaf84cc089526
SHA5126872407c6bbc1117235997fbfa4237cc70cd5a2d8feb77c08d87993d21680d7b1c0cdff205ebc559aef78dd9fb8a6fdc73e756588240f92f739e0c4f98349248