Analysis

  • max time kernel
    90s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2024, 02:51

General

  • Target

    2024-02-14_989dd3d293225f3a8b103ef939d1cf74_icedid.exe

  • Size

    423KB

  • MD5

    989dd3d293225f3a8b103ef939d1cf74

  • SHA1

    34c7a6ecd12c9af76a5e8d7b3447c7d46c7c28dc

  • SHA256

    0143e1a14f006ee1b68cbcf2c3d36b986f481d0fd9f3eac00e78adbd13dc5ddc

  • SHA512

    222ca00d22da6b115e920acf7efe27b4500501f427cf26ab5ab60502637cb83411f4b8ba20bdf4208d873b7443039bb6c623090e5cdd7555b5bad6d7fa1d3a97

  • SSDEEP

    12288:RplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:jxRQ+Fucuvm0as

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-14_989dd3d293225f3a8b103ef939d1cf74_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-14_989dd3d293225f3a8b103ef939d1cf74_icedid.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4892
    • C:\Program Files\silently\approach.exe
      "C:\Program Files\silently\approach.exe" "33201"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\silently\approach.exe

    Filesize

    423KB

    MD5

    1d6f6001f88007fd4dc5d5c4d7cac426

    SHA1

    08edf5a97f9ef9c35d585b33ce1e219d27ce4a6e

    SHA256

    e750f0335894c0ea053880771312eb77df2a3d6cf5f13810f8ca0969276fa6c3

    SHA512

    e03c466e46c789831074081b0fc450734c3e2c451d799d2404f264f68fee931ebd06340f25154c78f8a6b62eed3333b50e8747abe21f98d600fa23724dee6b99