732a1c6f444c753a8bafd6e88ffeaba7f0a09e87d12bcf17a91038090ee89b20

Analysis

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 19:22

Target

2024-02-19_0d3d285f362edd97592f5c5cc24ca29c_icedid.exe
Size

278KB
MD5

0d3d285f362edd97592f5c5cc24ca29c
SHA1

cf7e6a82078e4f113b217af706135d5b5db5f838
SHA256

732a1c6f444c753a8bafd6e88ffeaba7f0a09e87d12bcf17a91038090ee89b20
SHA512

5b5726866b79740f9b9dba975c1a761443493875a0b930d53bc85d342435087a58927cef592900add026e1bd05fa166b7d3a2327124aa68f53493c8d868c3145
SSDEEP

3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2036	Morgan.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\topics\Morgan.exe	2024-02-19_0d3d285f362edd97592f5c5cc24ca29c_icedid.exe
File opened for modification	C:\Program Files\topics\Morgan.exe	2024-02-19_0d3d285f362edd97592f5c5cc24ca29c_icedid.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
408	64	WerFault.exe	16
344	64	WerFault.exe	16

Suspicious use of SetWindowsHookEx 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 2036	64	2024-02-19_0d3d285f362edd97592f5c5cc24ca29c_icedid.exe	84
PID 64 wrote to memory of 2036	64	2024-02-19_0d3d285f362edd97592f5c5cc24ca29c_icedid.exe	84
PID 64 wrote to memory of 2036	64	2024-02-19_0d3d285f362edd97592f5c5cc24ca29c_icedid.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-19_0d3d285f362edd97592f5c5cc24ca29c_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-19_0d3d285f362edd97592f5c5cc24ca29c_icedid.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:64
- C:\Program Files\topics\Morgan.exe
  "C:\Program Files\topics\Morgan.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 1044
  2⤵
  - Program crash
  PID:408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 1052
  2⤵
  - Program crash
  PID:344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 64 -ip 64
1⤵
PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 64 -ip 64
1⤵
PID:1364

C:\Program Files\topics\Morgan.exe

Filesize
278KB

MD5
92e072c72e23ecc9e9a77cfcedb105f1

SHA1
9c7b86aa014280f0cd535248eaf752994665c207

SHA256
368960305ef0d78e877cd1058036c8196b6ca96334af0c341560aaa52ae15a5d

SHA512
b84656809f615eb7c95ac8721fc8ced7710f7fa2b2f555798ab2854c51eb6e07e68908f27a9108eb77e36e6c197eb9eb8eac7fe07ad520a390f4599c03bf9772

Download Submit