00831e6415f5867bd24ad5eb864efded6b02fa47134254c564dd1d896dcdbb9b

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-13_6624e883b83f052a66288435227031f5_icedid_scarhikn.exe
Size

221KB
MD5

6624e883b83f052a66288435227031f5
SHA1

c248fef9256920270477728e7dae38191193870a
SHA256

00831e6415f5867bd24ad5eb864efded6b02fa47134254c564dd1d896dcdbb9b
SHA512

cf4145034894b51c711b246e1ae8064d85277146e7ea1b20f895e127a9736c978cccab56d8584aa24fb13ae43360ebddce75dd60f1902eae84ea57bbcf1e8f7d
SSDEEP

3072:cP9lfwVjbH3MZ0YQRYrgvbCPpEe3f1C/q/CM4BoQF9nPYvQd2a:cP9lEH3MqYQugsf1CCwn4a

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 4892	2044	2024-03-13_6624e883b83f052a66288435227031f5_icedid_scarhikn.exe	85
PID 2044 wrote to memory of 4892	2044	2024-03-13_6624e883b83f052a66288435227031f5_icedid_scarhikn.exe	85
PID 2044 wrote to memory of 4892	2044	2024-03-13_6624e883b83f052a66288435227031f5_icedid_scarhikn.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-03-13_6624e883b83f052a66288435227031f5_icedid_scarhikn.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-13_6624e883b83f052a66288435227031f5_icedid_scarhikn.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\yyyy.bat
  2⤵
  PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yyyy

Filesize
221KB

MD5
339d9c07431521a72676648542545cba

SHA1
6413a3c33ce2332b100159dce35eb24d62e11d94

SHA256
ab5f32fa35342ba38822168cf9e39d33c1abebf695eded6111ae04be39e5bea9

SHA512
50f085fb0a0037f455dafca07e9a0bd99cd95bb7cc7719d28d95d7fa6993754783f5c52ce77fea4b2d574363f9e7eef35d7555578fe03ecfd7428601e5e62e0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyyy.bat

Filesize
337B

MD5
f0628c76595ba67cb62ab4979435af48

SHA1
7b28c9fc12343ab5588246577716c66db55bb14b

SHA256
7cf3702f137b77e031ae2f4e2bcdd201c4fbc0d61da9c7aa714176fda6a373a3

SHA512
3d61de031c90feaef8f8342a8e45212bc2f67eae8c738a98680bad4b1ae52bb72f7d83ad2ee03ec24c16201e78d5fdb83b003acb88f713fae09e6ebb0b6cc609

Download Submit
memory/2044-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2044-6-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download