Overview

overview

7

Static

static

3

2024-02-20...id.exe

windows7-x64

7

2024-02-20...id.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    143s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-02-2024 19:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-02-20_f975766754520e6283605fed8d179633_icedid.exe

  • Size

    2.3MB

  • MD5

    f975766754520e6283605fed8d179633

  • SHA1

    2905867a34cd79ba72eea0055cd4b075ef0bb4e7

  • SHA256

    4910ceba4f06354c8753427785f434d53e034d915f6ed709abc8ad2a24e344e7

  • SHA512

    e267fde503d7a2e114dc047e363ded976d32455f5f3bbde31eba29ab0714aa71a007f752cd094c4342ced94d25a614bf626c80bde51694393c5f78ffde579e77

  • SSDEEP

    49152:RBsp4fEu2ZnPgfzmPY+q3Y5yqwRC1xV1X94xVxmY4S:Psp4fEumnKzmPY+q33nRC1xV1XyR

Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 58 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-20_f975766754520e6283605fed8d179633_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-20_f975766754520e6283605fed8d179633_icedid.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Users\Admin\AppData\Local\Temp\2BA4.tmp
      C:\Users\Admin\AppData\Local\Temp\2BA4.tmp
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      PID:2640

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\2BA4.tmp
    Filesize

    145KB

    MD5

    c610e7ccd6859872c585b2a85d7dc992

    SHA1

    362b3d4b72e3add687c209c79b500b7c6a246d46

    SHA256

    14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

    SHA512

    8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

    Download Submit

  • memory/2420-0-0x0000000002450000-0x00000000024E2000-memory.dmp

    Filesize

    584KB

    Download

  • memory/2420-1-0x0000000002450000-0x00000000024E2000-memory.dmp

    Filesize

    584KB

    Download