0247fe8f412a981b2d3a5b059a198b3645ab0f1489b5fa885f139fe5e1577252

Analysis

max time kernel
134s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 05:26

Target

2024-03-13_05aba8ec8a4795b19914bd3d30cc1239_icedid_scarhikn.exe
Size

221KB
MD5

05aba8ec8a4795b19914bd3d30cc1239
SHA1

18ef9440b5ed0cf4f25a49524e5db06b8f615a50
SHA256

0247fe8f412a981b2d3a5b059a198b3645ab0f1489b5fa885f139fe5e1577252
SHA512

1120ec4981f7e4ae70453bef8d471ab28f0caa3c2a1fd309db27e3f93051367309602de509122f50be33e2a8e9051f75637cc34479bc674e94c42d028ffe692a
SSDEEP

3072:cP95fwVjSH3MZ0YQRYrgcbNPpEe3f1C/q/CM4BoQF9nLYvQd2a:cP95Eq3MqYQugGf1CCwnsa

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1120	896	2024-03-13_05aba8ec8a4795b19914bd3d30cc1239_icedid_scarhikn.exe	90
PID 896 wrote to memory of 1120	896	2024-03-13_05aba8ec8a4795b19914bd3d30cc1239_icedid_scarhikn.exe	90
PID 896 wrote to memory of 1120	896	2024-03-13_05aba8ec8a4795b19914bd3d30cc1239_icedid_scarhikn.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-03-13_05aba8ec8a4795b19914bd3d30cc1239_icedid_scarhikn.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-13_05aba8ec8a4795b19914bd3d30cc1239_icedid_scarhikn.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\yyyy.bat
  2⤵
  PID:1120

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\yyyy

Filesize
221KB

MD5
57898a266480ac910aabb847a122c05c

SHA1
abcfde5f01c187ac4fc441e03cf8726ec168591b

SHA256
4f603c1004e91a15717ab09bb0c307c886d6e0438fe9cfbb5b5ae3327ac18c45

SHA512
7a52349f0e1e33b2175dfd48a73ca617b49436e89f2d03b5b3ac7d6ae471bffffdbf973d14efa75002c0c6bc07ef90b6f555320e3c655c2ea93ba62588a43097

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyyy.bat

Filesize
337B

MD5
f0628c76595ba67cb62ab4979435af48

SHA1
7b28c9fc12343ab5588246577716c66db55bb14b

SHA256
7cf3702f137b77e031ae2f4e2bcdd201c4fbc0d61da9c7aa714176fda6a373a3

SHA512
3d61de031c90feaef8f8342a8e45212bc2f67eae8c738a98680bad4b1ae52bb72f7d83ad2ee03ec24c16201e78d5fdb83b003acb88f713fae09e6ebb0b6cc609

Download Submit
memory/896-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/896-6-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download