Analysis
-
max time kernel
119s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
09/01/2024, 06:38
General
-
Target
2024-01-08_2d06d8e103a8393d9765908d27b7a606_icedid.exe
-
Size
377KB
-
MD5
2d06d8e103a8393d9765908d27b7a606
-
SHA1
934b51188ef0d4b841f8e1d16641f94027761a83
-
SHA256
5cb9efc7d5d18ca60207799d9cc57f0cb21985091102025c2b268ea291901572
-
SHA512
8eef0a08cd7a5829a162d11fed39f8fd03d3691257565e99be06335b8e2a52240d646ad114aca96de0e6208d1d73db5bba102f91de2e444a0fb4937c2ef28c2a
-
SSDEEP
6144:+plrlbbDdQaqd2X/96fr3KFEUGjr8uB2WgcA0cpXEVNrvGZ4FUqm6:+plrVbDdQaqdS/ofraFErH8uB2Wm0SXj
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-08_2d06d8e103a8393d9765908d27b7a606_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-08_2d06d8e103a8393d9765908d27b7a606_icedid.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Swedish\commandline.exe"C:\Program Files\Swedish\commandline.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
377KB
MD5ada2fb4871f5adb459a0407377d79a71
SHA1061cef8830b402b950d8f1261cd99dee91bfe14d
SHA2569cb91f73dd1d7b189afefb83cd135614c6e8447119e0d4863c1515d2af1ccab6
SHA512ad3704722d8d866c2662bff525dd9d5b803eff865bfb15f64557c8b74f7ee0f34e003335d1c63b960f8d2a6ad0f8c528035728b8ea1491ef8f6b4c67909b2278