Analysis
-
max time kernel
91s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
20/02/2024, 02:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-20_05875bc73e332d2acfd42392a3edb1da_icedid.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-20_05875bc73e332d2acfd42392a3edb1da_icedid.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-20_05875bc73e332d2acfd42392a3edb1da_icedid.exe
-
Size
6.5MB
-
MD5
05875bc73e332d2acfd42392a3edb1da
-
SHA1
206e0448aac43d40f6a34ec65ac97daeec977c9a
-
SHA256
720ac9386aacbfd78f5cf377db051dc05401b7d8bc0d82f215939d03c3f0b89a
-
SHA512
b9d6f43b244af931e64a68734c9806b41b3c058b88a077e5efae69ee5a40b48b4f3c5c32bac6235cef20ffab7821cce046f6589f475ecccedc55975ab1685a0a
-
SSDEEP
196608:4LP1i1dE25MX3YzALrvTnnhuwWA1XSB/D5Y:wWdE25yiW7nnh1WoXSp
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1296 2024-02-20_05875bc73e332d2acfd42392a3edb1da_icedid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1296 2024-02-20_05875bc73e332d2acfd42392a3edb1da_icedid.exe 1296 2024-02-20_05875bc73e332d2acfd42392a3edb1da_icedid.exe 1296 2024-02-20_05875bc73e332d2acfd42392a3edb1da_icedid.exe 1296 2024-02-20_05875bc73e332d2acfd42392a3edb1da_icedid.exe 1296 2024-02-20_05875bc73e332d2acfd42392a3edb1da_icedid.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD5afeada1c96da250c149a65078792fea9
SHA105edf45f6a100a72a5117910ad1fe910aae5c618
SHA256db5d3594ab06b3d458a1472959ba1f703e98104ba94fde6b953697fa83b0a601
SHA51270437bb78f950855c9b1d1597318755c58c8d4f430211aaa9d8829a49bcd11d993b3589cf1581e65ab7c1b40dd94a8b6f1706d9e5f55ee17bb021e2914ee33c3
-
Filesize
8KB
MD55f0b9fbfe549f98e5e34d0be462c4a02
SHA1362a0c5f7482f502f457fb45858abed83643e967
SHA256625df9cf081f1d4a1c216c3100541ddfb82755c3f33015316833e88e307656c1
SHA512fbe863271c7cdbfb6b9a682cf5c8dd52259e83b1d3f58df3ca3c398d97c74ac2d07707f754d46d27e3703b49f2f5182093fd95967f3e1428f01b28b384ef605b