Analysis
-
max time kernel
93s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
03/02/2024, 07:54
General
-
Target
2024-02-03_7a47310800adaafaa1d0f7e0738f790e_icedid.exe
-
Size
10.4MB
-
MD5
7a47310800adaafaa1d0f7e0738f790e
-
SHA1
86b0527708d79ada01b343fe3d5d82fe6eb089f1
-
SHA256
ba3c442473e47e7fab8a26a5a6c720531ad0f1819acdeb87d82064295b9da1a9
-
SHA512
7774584e28e85219ab569b89fdec751d8df62643f5c73a9ca7490caaf1db8fa1d460f4c05abcdef633ad32bc42ab95a7e8d08c6a3550229fb8d772312db139ec
-
SSDEEP
196608:NmY+Wpa0M8JUNBdHpkqSBcF7n/S6KUM3zCTUDv2BHh847DJZq9vLxbOdUihuEQk1:v9yndHpHSOFT/STUM33w84/PqpLChJFd
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-03_7a47310800adaafaa1d0f7e0738f790e_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-03_7a47310800adaafaa1d0f7e0738f790e_icedid.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\autorun.exe"C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\autorun.exe" "SFXSOURCE:C:\Users\Admin\AppData\Local\Temp\2024-02-03_7a47310800adaafaa1d0f7e0738f790e_icedid.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4fc 0x3481⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5683841749546e4f28ed919cec6b26d51
SHA14a34af8e704e2a66f6e5e8bee6efb99e3c714e63
SHA256024662b84c16ae119705cc7c9bfeb576a71da172967b6e3a21c1a3ee30a6d899
SHA5121bc6b15358db8d81d9b5b0b866e1e5b2c93ac28533750503236db66af6d6d34547d09395f5b85a1a21fea87e2da6c3841fa5332f4cfd62e6a5f95d0b63fa1c73
-
Filesize
3KB
MD59163902f5df4ca5c99362f8a9ca6ef29
SHA15c1f2d8429812c956f19b3fd6c3becb25a38349b
SHA256f1bf63665c7bf8f404efd844c0de6e1b1f4973bf04119c63ec2400c596335f24
SHA512dc856c19c5f0396563f89c878a12cf0dd9292fffd03b977a5f389c2dc73e0fa37597329b8940d224eefc8768effdf0872bad9fe33df0f2d9de353e9761675f52
-
Filesize
4KB
MD566c831e89ae3f9dcd8cb1f969e8a8caa
SHA13b5368f5bec5472cb4fba7ea696fd2d706969556
SHA2560bbf290a5ecc17fee256e87385db70d6d0b104de95b962e1b4b12d7a020524b0
SHA5124d316a5acf8ded4072641ba8b334e95683aa8d5103fe5ce2ecb77aa688bc82a458a6eb00446e91d69379bb2b8c519209e4737da746d8da560387f5ea1e42ba48
-
Filesize
164KB
MD5fbd9931fde17542a7940b75e5a1053f2
SHA1cc2d04f1a537efc2e17d5be775a70dd73eaf69e3
SHA2565dba78a15c06e9df1354be213b9ad9dce9c738598bc45fc8a0662f9bfcecccf4
SHA512b953568e169ced59eb83790fba07b856143aede4dd65e1e8f9a822eb3db4d704889c75c3eb917b056d2fd33133f80622867fb89dc97671923bcc5d2024427757
-
Filesize
5KB
MD54ac68b020a7a87cf549fa0581d9c5ded
SHA1632f554f33a908c7560df747eb0db62a4e223426
SHA25626c5987bb4e7288f3bcdcd251d5b7898938d03af807ebdead6fcde78d5110c8d
SHA5120f9a02b548fc36c8353c282c8806bde2845faeefe5f9546d31bd487a44565228f4de1a9ea07d0578279e9c1412ba3bd949801d9d58749bd5e60056a37f109b2a
-
Filesize
19KB
MD517240f2c216913983211db43e2a523e1
SHA1c1dc6def764d2caf18a8d24e5d872291eadccfd2
SHA25676dd6f57dc2747cddc0979f9102491158fca6e42922823776f0d1dd56037307c
SHA5127fd95da3a2d7e80abcf5b4a5e8413eed1fc7fc0f8ef5764b8cddb08704d212003b58aed05fe0b52ae13507daeaf8f1cb64be78201c4ab44eee747686c55b4e68
-
Filesize
565B
MD5f1c7b624cc1e1951abc6ffac0b27f263
SHA1bedae50a9b814e2a00ec7ffb36990f9a6d1a3419
SHA256b03ce640fa8466673d98d2d54cc90cecb974cf2c1affdeda960e5cba05ddf3fe
SHA5123139a757818500312f7ad9d1f0eb40bf1695c86c9597c84f649d92c14861f7ae613843804840e7b391f090af1b34034bc2d001370e153d1a9d92c38cb842dc48
-
Filesize
52KB
MD5ebc27d90d0cbb1b0a929aca96657e715
SHA1dfe1b06876a3591c8daf4aebeb39dbc08b0330af
SHA256435a54e80c3faf98c77c512c2f1f4d58bc7235c9b4692a969248e64e00845ff7
SHA51211bf6bf32f49b018ec96c00c63d2e3858dcd0b7bbee4ced1e71269e37689271ee11f89883bb4cf6fc730c79abcee61454771e810333d0b1f3204460a748f852c
-
Filesize
581KB
MD539483fcb4084b47932cfb2840a314d80
SHA1e9ce660aa5ffc04ec6af5cd36a29bfbca1950eb8
SHA256016f9dc77c7bb3ce88ed2c069783df38f5ab5696e960ed86d0bff6d81456d16e
SHA5129160716e9051eba308c75bb175e8431e63d40a1e2df2161b7e3363ff8d109db2b41f5db0aebc043e3ebee1060db11adcf3db1803ab0b90d94a55a0e5a0c99baa
-
Filesize
66KB
MD5949ab21a680e26ddc6780e371fefcfe8
SHA121363ae56491f722696516dac6a8adcdcb63ec4e
SHA256a9e0ed32aee49ade52ed444457163f5ea621e96e4c88e3c227dc13147de9c4b7
SHA5126a74fbbc2fb64e1b28be955b38ee30ae5e29066d11007ba85185729f5cbb0dd318a3b0520b4c9faee0de64d1127d60aedb90b7e2b8c9d8327073fbff9261adf1
-
Filesize
1.1MB
MD5b8de1cf2083cf9b2181c3b79be2cf443
SHA10a5f08f9312769732dc556b37094dd3b00048dd1
SHA2564826794da4099cbded28be017769411a4b8b223d682044eb7bb0b65737b9c5aa
SHA512f9bd79c8d858727fff144b7d84ff3bc06ddb5ee980acec0f932ac0695e646c67afb1cc6f9b0dc8907ea6a4b579a3bfc9bdcdc348e684a1f0750f4c5dd5e4a5df
-
Filesize
1.0MB
MD580bf82d854583ed5a107c8083adbef38
SHA10eb6e296d0dcc43ea6ac7da8ab2fbfdf79ec28c1
SHA25696bc706213a594561e0c055c26bf5228436124508e6a5cd077b949b06f197e88
SHA512eb99b7f29a1b207afea2f0a87f30426bc0a6549a198e61cb3534c6f6510be3a37f548ef3c1faa5a2717e796bce82d737dca1c842e3ceac56900ab28223bb9316
-
Filesize
322KB
MD5c3256800dce47c14acc83ccca4c3e2ac
SHA19d126818c66991dbc3813a65eddb88bbcf77f30a
SHA256f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866
SHA5126865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
