Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 15:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_5ca3d762e32d652adb1939722fc14a7b_icedid.exe
Resource
win7-20231215-en
General
-
Target
2024-01-25_5ca3d762e32d652adb1939722fc14a7b_icedid.exe
-
Size
388KB
-
MD5
5ca3d762e32d652adb1939722fc14a7b
-
SHA1
cbb246517edf750e810feab219e4040d33d58db8
-
SHA256
73d2a32211f6a0cc853b695c789ba0bcb2a5a3d08b59989e4a703f04ca6e46e7
-
SHA512
8a9b70bc6d27723a84a03648bd64c85b47d8499e64e3d5d8f65389888399c55df6b7598cc084db491c54f45edb9e92905e71a10d4b0a2f6996af25e19ea8d775
-
SSDEEP
12288:2plrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:SxRQ+Fucuvm0as
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
handling.exepid process 4884 handling.exe -
Drops file in Program Files directory 1 IoCs
Processes:
2024-01-25_5ca3d762e32d652adb1939722fc14a7b_icedid.exedescription ioc process File created C:\Program Files\message\handling.exe 2024-01-25_5ca3d762e32d652adb1939722fc14a7b_icedid.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
2024-01-25_5ca3d762e32d652adb1939722fc14a7b_icedid.exehandling.exepid process 2972 2024-01-25_5ca3d762e32d652adb1939722fc14a7b_icedid.exe 2972 2024-01-25_5ca3d762e32d652adb1939722fc14a7b_icedid.exe 2972 2024-01-25_5ca3d762e32d652adb1939722fc14a7b_icedid.exe 2972 2024-01-25_5ca3d762e32d652adb1939722fc14a7b_icedid.exe 4884 handling.exe 4884 handling.exe 4884 handling.exe 4884 handling.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-01-25_5ca3d762e32d652adb1939722fc14a7b_icedid.exedescription pid process target process PID 2972 wrote to memory of 4884 2972 2024-01-25_5ca3d762e32d652adb1939722fc14a7b_icedid.exe handling.exe PID 2972 wrote to memory of 4884 2972 2024-01-25_5ca3d762e32d652adb1939722fc14a7b_icedid.exe handling.exe PID 2972 wrote to memory of 4884 2972 2024-01-25_5ca3d762e32d652adb1939722fc14a7b_icedid.exe handling.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_5ca3d762e32d652adb1939722fc14a7b_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_5ca3d762e32d652adb1939722fc14a7b_icedid.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files\message\handling.exe"C:\Program Files\message\handling.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4884
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\message\handling.exeFilesize
388KB
MD510d9445d6ea64fe16848eadeafc98d5a
SHA1edb8d1505da64c25966f0e660bc7200057f08421
SHA2567b065a9f1c6ffe4b2759304764f22cf99f41a1c99980f6dd182c58f2e0a4ba87
SHA5124562f608c374b634248221795111063d491e12aae82d00bab8094370e30f2e03961343b0b1e3a4f738a366d4a12e4c32fdd3a5954bb3aca67a904036997e790c