Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 19:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-11_a87ab2873494dfa400f928b4488d48d0_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-11_a87ab2873494dfa400f928b4488d48d0_icedid.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-11_a87ab2873494dfa400f928b4488d48d0_icedid.exe
-
Size
1.8MB
-
MD5
a87ab2873494dfa400f928b4488d48d0
-
SHA1
d30158f680cd9c0bd5aff5b5685f44625dccb8b9
-
SHA256
75b05c18335aba02bd86afe8a8cc9091bb312529ec319a20107ced6195fbf73c
-
SHA512
b6ef704c461a763b168213b4e8a79fc4a5281bc68716e12c7c0400935c3a4762660dfe1bb3f2296f87f50d56d56bb7e0eec8eeffdcc6a7d8c9c322c793008693
-
SSDEEP
49152:Z6ikU0bnaThVESGIJ20KcPYN2t+5pWNq5XyyIq3xrpj8yNvY1R4P7HjC2KymhuXH:AbkVEetDAN2tEpdyyIq3xrpj8yNvY1Ry
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2080 2024-03-11_a87ab2873494dfa400f928b4488d48d0_icedid.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2080 2024-03-11_a87ab2873494dfa400f928b4488d48d0_icedid.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2080 2024-03-11_a87ab2873494dfa400f928b4488d48d0_icedid.exe 2080 2024-03-11_a87ab2873494dfa400f928b4488d48d0_icedid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-11_a87ab2873494dfa400f928b4488d48d0_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-11_a87ab2873494dfa400f928b4488d48d0_icedid.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2080