Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-03-2024 00:32

General

  • Target

    2024-03-12_7ccceaa846c33c3dabd66292b3c4f348_icedid.exe

  • Size

    418KB

  • MD5

    7ccceaa846c33c3dabd66292b3c4f348

  • SHA1

    dbf6f8663c9c422800a66d6d2c5ad34b3585885a

  • SHA256

    f672044cff81651ec81e3dfbf910ba0ced41654d187f7384eac89599487b16a1

  • SHA512

    9b04988bf9955a2e317ab08512854706f9a96f2c0c2b54b348e19c72a0de8a9c1a71066c1a4b36614bf1a809a5efc1abcdc256085f94d7c7d9f1af3db83eccc6

  • SSDEEP

    12288:QplrVbDdQaqdS/ofraFErH8uB2Wm0SX/Nr5FU:sxRQ+Fucuvm0a/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-12_7ccceaa846c33c3dabd66292b3c4f348_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-12_7ccceaa846c33c3dabd66292b3c4f348_icedid.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Program Files\Security\topics.exe
      "C:\Program Files\Security\topics.exe" "33201"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Security\topics.exe

    Filesize

    418KB

    MD5

    ad47c432306db819ecc369591183b624

    SHA1

    6ea6b19ef3242ae4a4de9330ed5dff809725a28c

    SHA256

    7f25c21c292ae92edb5ce2bdbd4276621c8b49a19bfa60713406f81498035036

    SHA512

    9d4d561687de63e5375772e3ac08db1ee176cfe897587a9ebcc9a647e707fed042b041a72b8a76744d18036b767074c00f3d8bddaa3a05f68e35df99273421ad

  • memory/2516-0-0x0000000000400000-0x0000000000573000-memory.dmp

    Filesize

    1.4MB

  • memory/2516-4-0x0000000000400000-0x0000000000573000-memory.dmp

    Filesize

    1.4MB

  • memory/4864-5-0x0000000000400000-0x0000000000573000-memory.dmp

    Filesize

    1.4MB

  • memory/4864-7-0x0000000000400000-0x0000000000573000-memory.dmp

    Filesize

    1.4MB