Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25-01-2024 17:26
General
-
Target
2024-01-25_399e5002f81dbd7619b1adaf13810b0b_icedid.exe
-
Size
383KB
-
MD5
399e5002f81dbd7619b1adaf13810b0b
-
SHA1
3beb7ec72cc15756d9cfe03a2858e75bdb7fd28e
-
SHA256
a6e6326b04de0c318060b9eb5dcc1e2c8c2498f463e10084b272d1c19fc0ef2e
-
SHA512
ca5e5c3d8ffdd5b92e7b5b02a81b80870160808d357a6941f2c714cbe3a0f22d4d030c143751bf4a61d83068fc5885d60c31e034b368254a19cf1cab466e1cba
-
SSDEEP
6144:JplrlbbDdQaqd2X/96fr3KFEUGjr8uB2WgcA0cpXEVNrvGZ4FUqm6:JplrVbDdQaqdS/ofraFErH8uB2Wm0SXj
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_399e5002f81dbd7619b1adaf13810b0b_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_399e5002f81dbd7619b1adaf13810b0b_icedid.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Schirmer\Addison.exe"C:\Program Files\Schirmer\Addison.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Program Files\Schirmer\Addison.exeFilesize
383KB
MD5e3b5b0aa628d8d33a9b04e05f001891b
SHA1b8dbdf4082d7842c1c8bc5320918a0aa25ba18d8
SHA256b33541367dfc83f54f19414e580c63f14992403bbcf2560c0ee9ea7cbb710347
SHA512222ae492232a7b154a231e83ba5d8478c38c57947c1fbb59a7af91b9b747ff57b18a0eabcda4bd897cd0119e63bb09196287bb7fa960434407c796e17d9b1c7a