Analysis
-
max time kernel
142s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
09/01/2024, 06:39
General
-
Target
2024-01-08_3f1c4fec6cf272d51b449242d7ee8a0d_floxif_icedid.exe
-
Size
4.0MB
-
MD5
3f1c4fec6cf272d51b449242d7ee8a0d
-
SHA1
70f50b36794a48037ebb83c0b2d1c53c5edb3953
-
SHA256
73a45021b62374d0754ce00c87b682d6abd1494c7d0b603dbb8abdc30aafa7c5
-
SHA512
c861c35a02110602face2af3a9b67dd648da0b2e4055300e823f29e79d2efdace122a53d44a92398fc590a222bae40442defbdbbd80dddedb934b88421921fa7
-
SSDEEP
49152:1B5nXN/5iGsRLt4ee8GAQpTByYceNSJP5/1mRAY+c4D5bp1ZPTQyL9T1/c8aV:1BpN+LIAUFyXNJ1mR3+xtPJXk8aV
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 1 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 24 IoCs
-
Modifies registry class 12 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-08_3f1c4fec6cf272d51b449242d7ee8a0d_floxif_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-08_3f1c4fec6cf272d51b449242d7ee8a0d_floxif_icedid.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ef438548477a858c7afe020ed3884387
SHA18cf71d67971341f8ffc8b97c5877b78cd3f06ef1
SHA256d965551f4f211c687a498204bf62b01f7291b38e02f972abd3b69bbdfec91927
SHA5128db0d205ee02ecddca4eec72f9aa1287512807a05e88c7b9e455ee17ab2a2ebf476c2febf1bcee1b49ec4750f896d94acb8e618fa34a3d3661e8e5aa5242921c
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
Filesize
53KB
MD59845f4499aaf5428b514457429a3c39b
SHA11e1174fc7091be6ba8f97a42620b021fc19d0b35
SHA2562ad0f08b500718ab82054fcda5c4e56cfb94bdb36feb2d373bfb2e3abc868252
SHA512766f4917c0063d1698cd7671ce8fea43f4454ab3630bb16e44ecb86e580d5fa76d9e9a2169a2cbcc9927620af95ce6441159cdc313c2a8b049f97c4adb5330ca
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
212KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB