Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-03-2024 00:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-12_7ccceaa846c33c3dabd66292b3c4f348_icedid.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-03-12_7ccceaa846c33c3dabd66292b3c4f348_icedid.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-12_7ccceaa846c33c3dabd66292b3c4f348_icedid.exe
-
Size
418KB
-
MD5
7ccceaa846c33c3dabd66292b3c4f348
-
SHA1
dbf6f8663c9c422800a66d6d2c5ad34b3585885a
-
SHA256
f672044cff81651ec81e3dfbf910ba0ced41654d187f7384eac89599487b16a1
-
SHA512
9b04988bf9955a2e317ab08512854706f9a96f2c0c2b54b348e19c72a0de8a9c1a71066c1a4b36614bf1a809a5efc1abcdc256085f94d7c7d9f1af3db83eccc6
-
SSDEEP
12288:QplrVbDdQaqdS/ofraFErH8uB2Wm0SX/Nr5FU:sxRQ+Fucuvm0a/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4864 topics.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Security\topics.exe 2024-03-12_7ccceaa846c33c3dabd66292b3c4f348_icedid.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2516 2024-03-12_7ccceaa846c33c3dabd66292b3c4f348_icedid.exe 2516 2024-03-12_7ccceaa846c33c3dabd66292b3c4f348_icedid.exe 2516 2024-03-12_7ccceaa846c33c3dabd66292b3c4f348_icedid.exe 2516 2024-03-12_7ccceaa846c33c3dabd66292b3c4f348_icedid.exe 4864 topics.exe 4864 topics.exe 4864 topics.exe 4864 topics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2516 wrote to memory of 4864 2516 2024-03-12_7ccceaa846c33c3dabd66292b3c4f348_icedid.exe 87 PID 2516 wrote to memory of 4864 2516 2024-03-12_7ccceaa846c33c3dabd66292b3c4f348_icedid.exe 87 PID 2516 wrote to memory of 4864 2516 2024-03-12_7ccceaa846c33c3dabd66292b3c4f348_icedid.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-12_7ccceaa846c33c3dabd66292b3c4f348_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-12_7ccceaa846c33c3dabd66292b3c4f348_icedid.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Program Files\Security\topics.exe"C:\Program Files\Security\topics.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4864
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
418KB
MD5ad47c432306db819ecc369591183b624
SHA16ea6b19ef3242ae4a4de9330ed5dff809725a28c
SHA2567f25c21c292ae92edb5ce2bdbd4276621c8b49a19bfa60713406f81498035036
SHA5129d4d561687de63e5375772e3ac08db1ee176cfe897587a9ebcc9a647e707fed042b041a72b8a76744d18036b767074c00f3d8bddaa3a05f68e35df99273421ad