Overview

overview

9

Static

static

3

2024-02-12...id.exe

windows7-x64

7

2024-02-12...id.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12-02-2024 19:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-02-12_33628cd52b1bfd9542bb92697bed025f_icedid.exe

  • Size

    711KB

  • MD5

    33628cd52b1bfd9542bb92697bed025f

  • SHA1

    48b61b6d7d39d11328a44ad5afdc8880fbf4a504

  • SHA256

    64d3e011670c866f617d738877c037fe4da74323a2b5b665cd54c0b83b44dd4c

  • SHA512

    45e97242c178b32ac842c92859f1d6c9415022e74cdb2275d8a8bb3b63d7e0d1b207791f0eec176554e0dcebebbf1838d83d905cea7eea501148b6189e54970b

  • SSDEEP

    12288:UyK5t4FM6X3f+B9h2+YEIBAHf267Ir6l4rAKeMb5LCeODyKUqDni:Uz9E+YEIY2pelSfcxUqLi

Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 48 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-12_33628cd52b1bfd9542bb92697bed025f_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-12_33628cd52b1bfd9542bb92697bed025f_icedid.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3032
    • C:\Users\Admin\AppData\Local\Temp\97AD.tmp
      C:\Users\Admin\AppData\Local\Temp\97AD.tmp
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      PID:3052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
    Filesize

    148B

    MD5

    38329e3fa227caec40007736e454b4e9

    SHA1

    f49f91f23dcfbf5248076bc1b502c1d684748af8

    SHA256

    f40517febe47405a495928d6ef765b12750c3b212417db92f45c66333b7d29c6

    SHA512

    5382c3838c075b818a13b69acbf7ffc237776758a7cc9f610390770c18cd79628f66e01500587b2223a70141a891e0b36d7cde706758a051307e2fb072e2790e

    Download Submit

  • \Users\Admin\AppData\Local\Temp\97AD.tmp
    Filesize

    145KB

    MD5

    c610e7ccd6859872c585b2a85d7dc992

    SHA1

    362b3d4b72e3add687c209c79b500b7c6a246d46

    SHA256

    14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

    SHA512

    8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

    Download Submit

  • memory/3032-0-0x0000000000270000-0x00000000002BC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/3032-1-0x0000000000270000-0x00000000002BC000-memory.dmp

    Filesize

    304KB

    Download