Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
24-02-2024 06:32
General
-
Target
2024-02-24_48beb3596fd7211f2d3fd1abb27df834_icedid.exe
-
Size
430KB
-
MD5
48beb3596fd7211f2d3fd1abb27df834
-
SHA1
e5a0cf57eba5a02aa4ae4feed049975b23c08276
-
SHA256
27ba88385dfea1a1e672c5e006a1126854dd5b88b1f1293b32a6f3d0de948be7
-
SHA512
ef2d9effbeeb2a89c4476945cfc5fb4efdf97a3cc7d739d205aedbb1e0cdde013cbb7ec8cbcfd2af3fa20db65f6a32dcf0ed5c2be9a756ef5ef54faa05352b38
-
SSDEEP
12288:WplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:yxRQ+Fucuvm0as
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-24_48beb3596fd7211f2d3fd1abb27df834_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-24_48beb3596fd7211f2d3fd1abb27df834_icedid.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Addison\Wesley.exe"C:\Program Files\Addison\Wesley.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
430KB
MD59d13113de95366d09266ae70466fe121
SHA1be4851139c791fc301079652be35b653d3424a55
SHA256c85f5866d7e3cfb57e308a9df719ed7f070963d1892884a3dc77f53058bb6b32
SHA512b901ab9a16ba506646af8a27620159b561927ecad782ceca37530fd3e2fd375fc5f86aa4313fada6da16f69ad8842715c621e9d516ccf747d396458d686cb04f