5b4f542255781d7ea091cfc321538b6f3aee79fc2eb4397dd684c5d94e41b6e8

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2024 21:00

Target

2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe
Size

273KB
MD5

f6eaddfb52fc5ef1a1006bab80a80415
SHA1

94d6d70483afe781bc9947205544a07ecbe956e5
SHA256

5b4f542255781d7ea091cfc321538b6f3aee79fc2eb4397dd684c5d94e41b6e8
SHA512

03d05747d0373664434afd2b1068238eab494b992ff42f711c0de44b05dc821eb350ac52c68d5099fd50ba32fd410874e71917e07af8ccec6bf8917238079578
SSDEEP

3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3104	.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\.exe	2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe
File opened for modification	C:\Program Files\.exe	2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1920	2616	WerFault.exe	17
3048	2616	WerFault.exe	17

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2616	2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe
2616	2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe
2616	2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe
2616	2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe
3104	.exe
3104	.exe
3104	.exe
3104	.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 3104	2616	2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe	39
PID 2616 wrote to memory of 3104	2616	2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe	39
PID 2616 wrote to memory of 3104	2616	2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe	39

C:\Users\Admin\AppData\Local\Temp\2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files\.exe
  "C:\Program Files\\.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 1020
  2⤵
  - Program crash
  PID:1920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 1028
  2⤵
  - Program crash
  PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2616 -ip 2616
1⤵
PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2616 -ip 2616
1⤵
PID:3276

C:\Program Files\.exe

Filesize
218KB

MD5
bee86165b3153b6c18af449ab43f40c3

SHA1
fc3c15e1e154fd5eed026e4b4fe007513fa0780a

SHA256
2c49fa2a954d17abf7b04c747debced9b8e4caf3206230a2666bc892811bac91

SHA512
b9b46ab1c92f3597afb6018511c66b71cadef15330d932997b55890f82eefec0e71735ed46abcbdb959abfb4c33d6ecaab99d00e4627308c30fd2b892758ad37

Download Submit
C:\Program Files\.exe

Filesize
273KB

MD5
e7d3d703f8c2d8e552f513f768f91e31

SHA1
4e78d7b93a2e50491987ca232f8457aa613a3a2a

SHA256
a6023ce6d11a782bc7b9e4626ae1889179d40dc61b8ae3e29a1e53c98d10a2eb

SHA512
2e313c50b0b7c2cc5da550a142694c87d1ff8e0a7a2686f1b0ef4419c28c7d0a2d90776cc202d5e92b22c2eb4a88ea14379f6a423cafe03373c09013d8b30687

Download Submit