1cb8637bdfdd8e34766e190d437e0faf032e422daac831c60da51aa9b355b6bd

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 19:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe
Size

735KB
MD5

76c0434129dea843bff45c52068cb38a
SHA1

2fbc2d88f33038ba941eb150fc3d8d0026ecd9b5
SHA256

1cb8637bdfdd8e34766e190d437e0faf032e422daac831c60da51aa9b355b6bd
SHA512

1555a6cf10bc18ff953300f203e44c1720f7fa1bf4fef5f0d67b8d197e334cf04e5cd97a9159df864c971e1ce441e2e4b03509ddb87c9207666f4893689ce249
SSDEEP

12288:hVn3OvVpoay/b227tMHn1obXHbGO9GCfqxv+T7y7+SHwRThQNSUf:hVqRc7tMH1uXaMT7E+SK8P

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1684	1776	WerFault.exe	27
2468	1728	WerFault.exe	28

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1776	2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe
1728	2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1728	1776	2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe	28
PID 1776 wrote to memory of 1728	1776	2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe	28
PID 1776 wrote to memory of 1728	1776	2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe	28
PID 1776 wrote to memory of 1728	1776	2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe	28
PID 1728 wrote to memory of 2468	1728	2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe	30
PID 1728 wrote to memory of 2468	1728	2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe	30
PID 1728 wrote to memory of 2468	1728	2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe	30
PID 1728 wrote to memory of 2468	1728	2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe	30
PID 1776 wrote to memory of 1684	1776	2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe	29
PID 1776 wrote to memory of 1684	1776	2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe	29
PID 1776 wrote to memory of 1684	1776	2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe	29
PID 1776 wrote to memory of 1684	1776	2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Local\Temp\2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-02-01_76c0434129dea843bff45c52068cb38a_icedid.exe" /watch
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 436
    3⤵
    - Program crash
    PID:2468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 720
  2⤵
  - Program crash
  PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\54634578.log

Filesize
40B

MD5
85ab0fb99ee569fcc5bae67fde77b694

SHA1
78a87b7b7a088c4932ebd1c3f4d55347be07de72

SHA256
67f37beada98e4b69d27326f8d12f2c457a7c309cf6c8536e4e8b05aa749b61c

SHA512
e4e06c16f2ec22deb4fe919f88f6b9ff2699f418a41b00e35a46f147dfff4d9b210517f747f88683474f82b2b5ce6d006e17be42efb10b019daa8d83e844e42a

Download Submit