Analysis
-
max time kernel
90s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25-01-2024 17:26
General
-
Target
2024-01-25_399e5002f81dbd7619b1adaf13810b0b_icedid.exe
-
Size
383KB
-
MD5
399e5002f81dbd7619b1adaf13810b0b
-
SHA1
3beb7ec72cc15756d9cfe03a2858e75bdb7fd28e
-
SHA256
a6e6326b04de0c318060b9eb5dcc1e2c8c2498f463e10084b272d1c19fc0ef2e
-
SHA512
ca5e5c3d8ffdd5b92e7b5b02a81b80870160808d357a6941f2c714cbe3a0f22d4d030c143751bf4a61d83068fc5885d60c31e034b368254a19cf1cab466e1cba
-
SSDEEP
6144:JplrlbbDdQaqd2X/96fr3KFEUGjr8uB2WgcA0cpXEVNrvGZ4FUqm6:JplrVbDdQaqdS/ofraFErH8uB2Wm0SXj
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_399e5002f81dbd7619b1adaf13810b0b_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_399e5002f81dbd7619b1adaf13810b0b_icedid.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Schirmer\Addison.exe"C:\Program Files\Schirmer\Addison.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
383KB
MD5e3105aea64f54c00bd834d256ab793c0
SHA113bdb06838e1a25da5bfdd98753086bfb21ffaef
SHA256796d5c24a70f1a2e0eb579ce28cc931d832ea27ad30524be1e45d19079d93e01
SHA512f7e668b4576fcec7584c1c8687edf5c87f360a147b2c0dd4b2a12364f4d937b6c2bfdf51b5548c9569985d920b1ab08ef669065bd9c173f5878f322424b8bd55