Analysis
-
max time kernel
90s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2024, 02:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-14_989dd3d293225f3a8b103ef939d1cf74_icedid.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-14_989dd3d293225f3a8b103ef939d1cf74_icedid.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-14_989dd3d293225f3a8b103ef939d1cf74_icedid.exe
-
Size
423KB
-
MD5
989dd3d293225f3a8b103ef939d1cf74
-
SHA1
34c7a6ecd12c9af76a5e8d7b3447c7d46c7c28dc
-
SHA256
0143e1a14f006ee1b68cbcf2c3d36b986f481d0fd9f3eac00e78adbd13dc5ddc
-
SHA512
222ca00d22da6b115e920acf7efe27b4500501f427cf26ab5ab60502637cb83411f4b8ba20bdf4208d873b7443039bb6c623090e5cdd7555b5bad6d7fa1d3a97
-
SSDEEP
12288:RplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:jxRQ+Fucuvm0as
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3572 approach.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\silently\approach.exe 2024-02-14_989dd3d293225f3a8b103ef939d1cf74_icedid.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4892 2024-02-14_989dd3d293225f3a8b103ef939d1cf74_icedid.exe 4892 2024-02-14_989dd3d293225f3a8b103ef939d1cf74_icedid.exe 4892 2024-02-14_989dd3d293225f3a8b103ef939d1cf74_icedid.exe 4892 2024-02-14_989dd3d293225f3a8b103ef939d1cf74_icedid.exe 3572 approach.exe 3572 approach.exe 3572 approach.exe 3572 approach.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4892 wrote to memory of 3572 4892 2024-02-14_989dd3d293225f3a8b103ef939d1cf74_icedid.exe 85 PID 4892 wrote to memory of 3572 4892 2024-02-14_989dd3d293225f3a8b103ef939d1cf74_icedid.exe 85 PID 4892 wrote to memory of 3572 4892 2024-02-14_989dd3d293225f3a8b103ef939d1cf74_icedid.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_989dd3d293225f3a8b103ef939d1cf74_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_989dd3d293225f3a8b103ef939d1cf74_icedid.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Program Files\silently\approach.exe"C:\Program Files\silently\approach.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3572
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
423KB
MD51d6f6001f88007fd4dc5d5c4d7cac426
SHA108edf5a97f9ef9c35d585b33ce1e219d27ce4a6e
SHA256e750f0335894c0ea053880771312eb77df2a3d6cf5f13810f8ca0969276fa6c3
SHA512e03c466e46c789831074081b0fc450734c3e2c451d799d2404f264f68fee931ebd06340f25154c78f8a6b62eed3333b50e8747abe21f98d600fa23724dee6b99