Analysis
-
max time kernel
127s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-01-2024 17:56
General
-
Target
2024-01-25_81f62ee6de1cc5614f6756775bda1187_icedid.exe
-
Size
383KB
-
MD5
81f62ee6de1cc5614f6756775bda1187
-
SHA1
e40093b5b2ac142e4fcd5506bc8593d0d8ba5d54
-
SHA256
48ff4ecf61bde36233b6c4d9820a1aa608de812d9d4901956f1a9e66f7c68173
-
SHA512
14c4757b3ae820272044a811ce3d16e3355f7b19594d42391a123de5dc716932d9ab764d39e765335135de59784cc02be1595db043dabf751e45467de75e09b9
-
SSDEEP
6144:eplrlbbDdQaqd2X/96fr3KFEUGjr8uB2WgcA0cpXEVNrvGZ4FUqm6:eplrVbDdQaqdS/ofraFErH8uB2Wm0SXj
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_81f62ee6de1cc5614f6756775bda1187_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_81f62ee6de1cc5614f6756775bda1187_icedid.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Dinstall\Follow.exe"C:\Program Files\Dinstall\Follow.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
383KB
MD50aa4ea28105812dd0be0b53b2edf4696
SHA13b3291df345cd183f8aeef8523deeb623d7b0cec
SHA256f4299c6945310a53c2977834d239911f39e9342ead54160c35834a1a2d2acded
SHA512518807c0ef680fc9f25c39f05aa15091e9c5f6649397cfcec809c9c5315b2727bf6f062cb38d7436ccf1b673f608626a791aa67f670c921f45238f38263b5ac8