Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-02-2024 18:25

General

  • Target

    2024-02-12_4c98e9cc4b8f9625902a2818fcdb28bc_icedid.exe

  • Size

    386KB

  • MD5

    4c98e9cc4b8f9625902a2818fcdb28bc

  • SHA1

    8f1987faebf4e013f9d197ebe71ed3a8025f712a

  • SHA256

    c83be55df9882dd0bb7bc4a200ee43d8d96a23b047891047f2d3f098ff0272f0

  • SHA512

    4ad2c99274eff8296ffea168b0a28c448c36979555157420387332121278376d23e273b0bb2b028b01c6f8e3b81471b35d2bafcfba07bf35f35cd6aed9408bf7

  • SSDEEP

    12288:pplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:rxRQ+Fucuvm0as

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-12_4c98e9cc4b8f9625902a2818fcdb28bc_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-12_4c98e9cc4b8f9625902a2818fcdb28bc_icedid.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:876
    • C:\Program Files\require\customer.exe
      "C:\Program Files\require\customer.exe" "33201"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\require\customer.exe

    Filesize

    387KB

    MD5

    e8671639fe29dbf0e0cbf108b7e61749

    SHA1

    8b7a6113671c9ba41c195197fc21e539ad6e909b

    SHA256

    fe7747e57f639b9b9d43476c187bb7d7b3e2e8d28682e11861036960e94a43dd

    SHA512

    858492b3395183be10aaa046470e4a69711dd7f9b2cd6423b1f09f2d3db7f50f2d10fdae15c439b497db0bdf19708abf19d7b5c2279d94e947ea5dcff65e44d3