Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/01/2024, 04:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-24_0a410cddd96de0ec39a0f5c81f5b34dc_icedid.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-24_0a410cddd96de0ec39a0f5c81f5b34dc_icedid.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-24_0a410cddd96de0ec39a0f5c81f5b34dc_icedid.exe
-
Size
311KB
-
MD5
0a410cddd96de0ec39a0f5c81f5b34dc
-
SHA1
612c77bc124db4d1abd58815f195eb204c156fe2
-
SHA256
0a0593186e77199635b676f9f5f7cc26053bba75cf08684da3288bb1c24ee458
-
SHA512
5cd70328331d765a5620ccaf659ce3423fed9bfcc8d1441ff0d74c309eddb49166c395c27ff7a3fe2becbd791417b6307e9c7401a5d83dedfb301de057781b22
-
SSDEEP
3072:lxUm75Fku3eKeJk21ZSJReOqlz+mErj+HyHnNVIPL/+ybbiGF+1u46Q7q303lU8O:fU8DkpP1oJ1qlzUWUNVIT/bbbIW09R
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2320 contained.exe -
Loads dropped DLL 2 IoCs
pid Process 2800 2024-01-24_0a410cddd96de0ec39a0f5c81f5b34dc_icedid.exe 2800 2024-01-24_0a410cddd96de0ec39a0f5c81f5b34dc_icedid.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Redistributable\contained.exe 2024-01-24_0a410cddd96de0ec39a0f5c81f5b34dc_icedid.exe File opened for modification C:\Program Files\Redistributable\contained.exe 2024-01-24_0a410cddd96de0ec39a0f5c81f5b34dc_icedid.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2800 2024-01-24_0a410cddd96de0ec39a0f5c81f5b34dc_icedid.exe 2800 2024-01-24_0a410cddd96de0ec39a0f5c81f5b34dc_icedid.exe 2800 2024-01-24_0a410cddd96de0ec39a0f5c81f5b34dc_icedid.exe 2800 2024-01-24_0a410cddd96de0ec39a0f5c81f5b34dc_icedid.exe 2320 contained.exe 2320 contained.exe 2320 contained.exe 2320 contained.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2800 wrote to memory of 2320 2800 2024-01-24_0a410cddd96de0ec39a0f5c81f5b34dc_icedid.exe 28 PID 2800 wrote to memory of 2320 2800 2024-01-24_0a410cddd96de0ec39a0f5c81f5b34dc_icedid.exe 28 PID 2800 wrote to memory of 2320 2800 2024-01-24_0a410cddd96de0ec39a0f5c81f5b34dc_icedid.exe 28 PID 2800 wrote to memory of 2320 2800 2024-01-24_0a410cddd96de0ec39a0f5c81f5b34dc_icedid.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_0a410cddd96de0ec39a0f5c81f5b34dc_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_0a410cddd96de0ec39a0f5c81f5b34dc_icedid.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Program Files\Redistributable\contained.exe"C:\Program Files\Redistributable\contained.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2320
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD5c23ca0d00658bd5c548661f2682084ab
SHA1d25c18ca24fa7e31a5163a530f15ebc691afd4a7
SHA256a7909ae1606f68d738f4c77295d0885f390f9da203049fb2a6d409b37aa1a507
SHA5122637f745bc04715b6620d8e183f5035f5e9da55160205659c843daec2a0b845dbfaf9c265de970f1227f654005d3d59440c17ae9a0e4fce41cfd88124f199980
-
Filesize
128KB
MD54ba6b32579066ec712c096a958680b11
SHA158a0409eb4cbf9beafe02b11836308685a35dfec
SHA2567a006c6f39222d2b70dab9fb8d296820643292317932b60c57d3edd2efb6420e
SHA5123a1ba971e55c8c7ea390d4ac53e0c297172888bfd34639a20be1aac38b61d4e0d0bbe7dc77ed84b227c89233d1d98fb9ad96b268faa8cb2cf1b71d5860517f57
-
Filesize
270KB
MD554efc2112476fab6ffd6df4011b28b6f
SHA1a1fc3bd889ec8d7dbd956d9043cbfc017122bb92
SHA25608b92d0d98422448312955df13e4ba494e04db572d2876da66b6c709faf2bb05
SHA5121952e149a3e0979f22bc6a4b848e5cb8e487a7d1212c967763f02aa14d34530a6f89c302931616b5b0a808f551787c5027b804fe154f4e43da5d3fd7aef4b619