Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
31-10-2023 18:48
General
-
Target
NEAS.2023-09-05_cf2c6269b806d9799c59d4a89299c318_icedid_JC.exe
-
Size
283KB
-
MD5
cf2c6269b806d9799c59d4a89299c318
-
SHA1
70ef4da2749a6acbe5fb3a17011feeecb8383fdc
-
SHA256
0b65ccb2afbcc448dbfe0a32fa2a90c03eefbb320e9209eac36d66848e19bc8f
-
SHA512
d03b0ad620f94290076f1b2c96a2fe84106db290b0558a6f2817e85c8432faa90eaef2e0207e548eff97ba5c8be72c4b2880b1af65a9bccf93643d457ffe615b
-
SSDEEP
3072:lxUm75Fku3eKeJk21ZSJReOqlz+mErj+HyHnNVIPL/+ybbiGF+1u46Q7q303lU8O:fU8DkpP1oJ1qlzUWUNVIT/bbbIW09R
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_cf2c6269b806d9799c59d4a89299c318_icedid_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_cf2c6269b806d9799c59d4a89299c318_icedid_JC.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\during\click-through.exe"C:\Program Files\during\click-through.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
283KB
MD558f1435d73d20a24b2b12dc2916a8c95
SHA19458615e1eb9a8533236df17d62674da6df26974
SHA256a30bc768c33529af9d4570a464cd027f7cb230edb9e88c2bed8edc1825a23e3a
SHA51291a68db5c131008fe4e8d29c62bb5f7aa27f4564760bc6daafabbdd46928700d67f53e5b97849eee0b03657d1a982b2aa9988d7afd318c64aa58e0dd9d8d5750
-
Filesize
283KB
MD558f1435d73d20a24b2b12dc2916a8c95
SHA19458615e1eb9a8533236df17d62674da6df26974
SHA256a30bc768c33529af9d4570a464cd027f7cb230edb9e88c2bed8edc1825a23e3a
SHA51291a68db5c131008fe4e8d29c62bb5f7aa27f4564760bc6daafabbdd46928700d67f53e5b97849eee0b03657d1a982b2aa9988d7afd318c64aa58e0dd9d8d5750