Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21/02/2024, 19:33

General

  • Target

    2024-02-21_44281f7e12d6a0d2b1fe8fd76a0d2a4d_icedid.exe

  • Size

    26KB

  • MD5

    44281f7e12d6a0d2b1fe8fd76a0d2a4d

  • SHA1

    c0baca3d4fa2698dae906b952a6a7b2f9743cbcc

  • SHA256

    9cb1724a5caedc00b49c6905690b1e5ec5855dc83ebc4ab751e4bea0e9fc1bbe

  • SHA512

    59fa08710a8e4ab1763a75cb51b6eab37d63c03231934a29faa2ca88edb6dd9ef14c39c808cdc775dc955d3c8ed9adb887d2039f7bdd035eb230c54533ea4ae4

  • SSDEEP

    768:c5A1kb3vrCB8CLu79lsafQj3n/AC6/1VKs:4fWp679ljyXICj

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-21_44281f7e12d6a0d2b1fe8fd76a0d2a4d_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-21_44281f7e12d6a0d2b1fe8fd76a0d2a4d_icedid.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      2⤵
        PID:1712

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1712-0-0x0000000000060000-0x000000000006B000-memory.dmp

      Filesize

      44KB

    • memory/1712-7-0x0000000000060000-0x000000000006B000-memory.dmp

      Filesize

      44KB

    • memory/2148-5-0x0000000077670000-0x0000000077671000-memory.dmp

      Filesize

      4KB