0247fe8f412a981b2d3a5b059a198b3645ab0f1489b5fa885f139fe5e1577252

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 05:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-13_05aba8ec8a4795b19914bd3d30cc1239_icedid_scarhikn.exe
Size

221KB
MD5

05aba8ec8a4795b19914bd3d30cc1239
SHA1

18ef9440b5ed0cf4f25a49524e5db06b8f615a50
SHA256

0247fe8f412a981b2d3a5b059a198b3645ab0f1489b5fa885f139fe5e1577252
SHA512

1120ec4981f7e4ae70453bef8d471ab28f0caa3c2a1fd309db27e3f93051367309602de509122f50be33e2a8e9051f75637cc34479bc674e94c42d028ffe692a
SSDEEP

3072:cP95fwVjSH3MZ0YQRYrgcbNPpEe3f1C/q/CM4BoQF9nLYvQd2a:cP95Eq3MqYQugGf1CCwnsa

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2884	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2884	2792	2024-03-13_05aba8ec8a4795b19914bd3d30cc1239_icedid_scarhikn.exe	28
PID 2792 wrote to memory of 2884	2792	2024-03-13_05aba8ec8a4795b19914bd3d30cc1239_icedid_scarhikn.exe	28
PID 2792 wrote to memory of 2884	2792	2024-03-13_05aba8ec8a4795b19914bd3d30cc1239_icedid_scarhikn.exe	28
PID 2792 wrote to memory of 2884	2792	2024-03-13_05aba8ec8a4795b19914bd3d30cc1239_icedid_scarhikn.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-13_05aba8ec8a4795b19914bd3d30cc1239_icedid_scarhikn.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-13_05aba8ec8a4795b19914bd3d30cc1239_icedid_scarhikn.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\yyyy.bat
  2⤵
  - Deletes itself
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yyyy

Filesize
221KB

MD5
11366717230374f3500797407dfe1de5

SHA1
5c29268c657252657fa1b5889764d4e606f4782e

SHA256
5957caf985909f305bfdd32eac18b536b7d8b4caf2b6411446bf2e034e6edce5

SHA512
dbeb5ce043c94e5fb72a96b639a269205f49bfe88ef880a592fa1ed06921e2f4194120d58573bfefde06039f874d000fb9da026caefe9e656fd75ddaa0aa9679

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyyy.bat

Filesize
337B

MD5
f0628c76595ba67cb62ab4979435af48

SHA1
7b28c9fc12343ab5588246577716c66db55bb14b

SHA256
7cf3702f137b77e031ae2f4e2bcdd201c4fbc0d61da9c7aa714176fda6a373a3

SHA512
3d61de031c90feaef8f8342a8e45212bc2f67eae8c738a98680bad4b1ae52bb72f7d83ad2ee03ec24c16201e78d5fdb83b003acb88f713fae09e6ebb0b6cc609

Download Submit
memory/2792-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2792-11-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download