Analysis
-
max time kernel
90s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
28/01/2024, 10:33
General
-
Target
2024-01-28_c90e63bd943c76452853d68b50fc2863_hacktools_icedid.exe
-
Size
14.8MB
-
MD5
c90e63bd943c76452853d68b50fc2863
-
SHA1
275cc47ba95fa69d73e4aff359740d8ded6dc7c4
-
SHA256
1213c2557ab8672b46b7d645733c5f0c6c0b7b573ac7f4fa1de5ca036c9797de
-
SHA512
29b5c2f3831cb4985b59ba391f32065d1dfd8c4d47d7ea4ca390866bcceefe21e48d80d667e1bb353b906cac7a08d7799417a1e11f437118ba3279cf6784f934
-
SSDEEP
393216:wo8okxWihS4wUNMngg9wnRqDiT90FGYoImRC:wo7HiQxUNMggoR3x0FG7ImM
Malware Config
Signatures
-
Detects executables packed with VMProtect. 5 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_c90e63bd943c76452853d68b50fc2863_hacktools_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_c90e63bd943c76452853d68b50fc2863_hacktools_icedid.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5c02c7d1533196b763a609cb682135bc8
SHA1c5fc40947b9629718ec23fc9f70c142e992205a9
SHA25659fffb829c9a1213f7ef990307241038a7159680df773409c71e4b2f03220156
SHA51274bb5202808def3c65058917bc67a5db8ce41fc1d14482cb3aac4b550ff666088a55668c5f4fb8aa9ee5299f2c75b6642b5563a32b064a62aa807d85034845a5
-
Filesize
2.8MB
MD58bdb4adf508bc2812296750833106032
SHA1a81da9ac4ffd26978b16ac2b0c40f8089767bf90
SHA256e9edd5cd39a4de7f626e6fb1adca8e2e5e1821a188bd94089042f16b3120c448
SHA5121d577089179a5fd899e23b9becac8332440b389b824d1e92ef1e5971dd41b2eb96f047e4754af9137b12f5e2eb1eee999809450f9418e256ecf0279b0a6dba95
-
Filesize
2.5MB
MD59278f470af127b840088a53023b70e65
SHA1abc9b3f6a11adc943db8d9469c2d164dc9ab2583
SHA256b9cc612ccecfc72a7f43a59a1d999389050074398754e5e9022e3f0192380291
SHA5124ef6cc0a361788b4ae2e6f95ff4a3b36183c848fc12eaccb6ab4295223f581ac3b6f27b025cb3dcfce0a1905880c73a88dc0135352c2818e9d2a436deaa48fcb
-
Filesize
4KB
-
Filesize
6.3MB
-
Filesize
6.3MB