Overview

overview

9

Static

static

3

2024-02-12...id.exe

windows7-x64

7

2024-02-12...id.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    87s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12-02-2024 20:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-02-12_ceeada283ab86ae2b6b0695c98a5003a_icedid.exe

  • Size

    720KB

  • MD5

    ceeada283ab86ae2b6b0695c98a5003a

  • SHA1

    3455052cf0b074a5293459c7b1987debe2bcfbe4

  • SHA256

    e6417eb97d34efa7b7fe845682d61f6a3c47610e8b9dc2ecaa6371c953497cfc

  • SHA512

    a3e2e48cdff324fd10d18cde00d2504c6cce2b032d3daed8735ccac6f015d4197c46cc6b31aaf69b45e1330d9ef70d586297f2625e421ea17ddf7b7d8a27d6b5

  • SSDEEP

    12288:VFFO1aqrLGKX3PxYLcgT9+8hOn26oIatiZCPvBUFhvtff50bn3i/5:VKEXT9i2C6Uq+hvFanyR

Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 56 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-12_ceeada283ab86ae2b6b0695c98a5003a_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-12_ceeada283ab86ae2b6b0695c98a5003a_icedid.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Users\Admin\AppData\Local\Temp\146B.tmp
      C:\Users\Admin\AppData\Local\Temp\146B.tmp
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      PID:2208

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
    Filesize

    148B

    MD5

    121b91365671dd3fd1769baffc017875

    SHA1

    043536467635ee5401d01ae3d000610a5c8b39c1

    SHA256

    88db5c114b285e9823dbb978a3565115d7d20f492ec8b41e2d5172687d52f9b1

    SHA512

    3770ed9c8bacf48da571a0e0b84c387d479bce18c57b7eba21fe5d09927fe7e5d2380f5646b84b85f82e855b3c833eb78e0271549043709de0f4885fac3a8125

    Download Submit

  • \Users\Admin\AppData\Local\Temp\146B.tmp
    Filesize

    145KB

    MD5

    c610e7ccd6859872c585b2a85d7dc992

    SHA1

    362b3d4b72e3add687c209c79b500b7c6a246d46

    SHA256

    14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

    SHA512

    8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

    Download Submit

  • memory/1680-0-0x0000000000290000-0x00000000002DF000-memory.dmp

    Filesize

    316KB

    Download

  • memory/1680-1-0x0000000000290000-0x00000000002DF000-memory.dmp

    Filesize

    316KB

    Download