Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/02/2024, 19:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-21_44281f7e12d6a0d2b1fe8fd76a0d2a4d_icedid.exe
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-21_44281f7e12d6a0d2b1fe8fd76a0d2a4d_icedid.exe
Resource
win10v2004-20240221-en
1 signatures
150 seconds
General
-
Target
2024-02-21_44281f7e12d6a0d2b1fe8fd76a0d2a4d_icedid.exe
-
Size
26KB
-
MD5
44281f7e12d6a0d2b1fe8fd76a0d2a4d
-
SHA1
c0baca3d4fa2698dae906b952a6a7b2f9743cbcc
-
SHA256
9cb1724a5caedc00b49c6905690b1e5ec5855dc83ebc4ab751e4bea0e9fc1bbe
-
SHA512
59fa08710a8e4ab1763a75cb51b6eab37d63c03231934a29faa2ca88edb6dd9ef14c39c808cdc775dc955d3c8ed9adb887d2039f7bdd035eb230c54533ea4ae4
-
SSDEEP
768:c5A1kb3vrCB8CLu79lsafQj3n/AC6/1VKs:4fWp679ljyXICj
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2148 wrote to memory of 1712 2148 2024-02-21_44281f7e12d6a0d2b1fe8fd76a0d2a4d_icedid.exe 28 PID 2148 wrote to memory of 1712 2148 2024-02-21_44281f7e12d6a0d2b1fe8fd76a0d2a4d_icedid.exe 28 PID 2148 wrote to memory of 1712 2148 2024-02-21_44281f7e12d6a0d2b1fe8fd76a0d2a4d_icedid.exe 28 PID 2148 wrote to memory of 1712 2148 2024-02-21_44281f7e12d6a0d2b1fe8fd76a0d2a4d_icedid.exe 28 PID 2148 wrote to memory of 1712 2148 2024-02-21_44281f7e12d6a0d2b1fe8fd76a0d2a4d_icedid.exe 28 PID 2148 wrote to memory of 1712 2148 2024-02-21_44281f7e12d6a0d2b1fe8fd76a0d2a4d_icedid.exe 28 PID 2148 wrote to memory of 1712 2148 2024-02-21_44281f7e12d6a0d2b1fe8fd76a0d2a4d_icedid.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_44281f7e12d6a0d2b1fe8fd76a0d2a4d_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_44281f7e12d6a0d2b1fe8fd76a0d2a4d_icedid.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:1712
-