Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12-02-2024 20:20
General
-
Target
2024-02-12_cceddb47dad13963ae2d664109b3f784_icedid.exe
-
Size
1.4MB
-
MD5
cceddb47dad13963ae2d664109b3f784
-
SHA1
50e90f05c5d3da8d68a5b0e3749d3bf6068033d7
-
SHA256
f574f42aab3c9986f192fc75a434361e510f79ea526c08b886fba1f6c1af7a71
-
SHA512
a149ac7ed4ff4a6d77fe476be860c15c923e09ec078d8f96c0f9a4f9300d01b2f1ad136c112db1bcfac834c02e66999b29ea0cf318d8c32644f6c519d541e513
-
SSDEEP
24576:QDhCfuvRglazfWGhJtex/BQOi0jamJuwCTkfM2tqnq+:2hCftazfWoJtexpQn0jawHScMC+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in System32 directory 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 48 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_cceddb47dad13963ae2d664109b3f784_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_cceddb47dad13963ae2d664109b3f784_icedid.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4CC9.tmpC:\Users\Admin\AppData\Local\Temp\4CC9.tmp2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5f46f842765ca73ba39616a77f0206606
SHA164a97fc2cf6b8061a9420a87c0f8a988fc8b9d32
SHA2564018d672b148c0f57a33a6282949241d56e0e416d60d38c78cb17381765e29ca
SHA512f77d97a192626f754bc8c902cec6df841dc0775338bd8bc49b8c4a863e56fc9208981708e39397fdc83f62efa3586101ad1c5c4ec3cd94a1d117170c20588b32
-
Filesize
848B
MD52b11b032d5af4920c4973edc436ea93d
SHA14aa8d79696478d20e7837dc6a0fb63338b222e88
SHA2565208c10fcf325adf921721d4e36f71393a180a51efb6d4cc50e7eef2573ce449
SHA512648beaf6065a5e937c9a5fd7b34ef0fb4daba79a967183244cbe8321e1402f1dbeee6ac4916184b3d6b130cc40aa881a6e6c81ee9bc08db7a162c7fbfb539065
-
Filesize
64KB
MD5083c891abc563301a8fb52bb8706a403
SHA1ad38dba313710cbf9cf63b9adee96deaa264d308
SHA25644742cab8f45a9ae37fa70e1e350839ca29881ab8e0cde0624ccd6ad662e408d
SHA5121fefaeaffdffc791dd70c19629b3d57e07dcc08e9a359b13684083b05d7df5e2d944222d86e1964025b226239cfa17e7247399038c4f4ccae81acdd0f427f9eb
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666
-
Filesize
296KB
-
Filesize
296KB