3fded6395bd418b8d2a5581fda54c2ffbfc077ff84dcae0529117983d1c5697e

Analysis

max time kernel
92s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 06:02

Target

2024-03-13_d991c7bbe2c9f89777d30c76a0d27cb6_icedid_scarhikn.exe
Size

221KB
MD5

d991c7bbe2c9f89777d30c76a0d27cb6
SHA1

b18dc3118a75535b595b5f7b36b440de9abcece8
SHA256

3fded6395bd418b8d2a5581fda54c2ffbfc077ff84dcae0529117983d1c5697e
SHA512

5b90ed536d5141248472527ad631beacdded0f5fb06e425b386de1c259eff4298b9cb8052ad731699e8a48805b56d76e96e6e05f97bd09080be11c93fa539e0a
SSDEEP

3072:cP9lfwVjSH3MZ0YQRYrgvbNPpEeqf1C/q/CM4BoQF9n2YvQd2a:cP9lEq3MqYQugIf1CCwnxa

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 3008	804	2024-03-13_d991c7bbe2c9f89777d30c76a0d27cb6_icedid_scarhikn.exe	85
PID 804 wrote to memory of 3008	804	2024-03-13_d991c7bbe2c9f89777d30c76a0d27cb6_icedid_scarhikn.exe	85
PID 804 wrote to memory of 3008	804	2024-03-13_d991c7bbe2c9f89777d30c76a0d27cb6_icedid_scarhikn.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-03-13_d991c7bbe2c9f89777d30c76a0d27cb6_icedid_scarhikn.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-13_d991c7bbe2c9f89777d30c76a0d27cb6_icedid_scarhikn.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\yyyy.bat
  2⤵
  PID:3008

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\yyyy

Filesize
221KB

MD5
73da9a2ab8f3d73e3361b3955046e510

SHA1
ba90b032f458984198e311b4b2fa39bbae193d92

SHA256
14c35f479ed6f7543108b3e646e986c59eee45f51635eb0a5e24cf7b64bb35ae

SHA512
8dc1983058f9e1a95ad98ddadcbee28d67b8f14e7dc4bf417a26f2589db18123e9ba81a3ce5046fbfcdd2fb4cb100345066354d890ac266683ae7c66be7192f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyyy.bat

Filesize
337B

MD5
f0628c76595ba67cb62ab4979435af48

SHA1
7b28c9fc12343ab5588246577716c66db55bb14b

SHA256
7cf3702f137b77e031ae2f4e2bcdd201c4fbc0d61da9c7aa714176fda6a373a3

SHA512
3d61de031c90feaef8f8342a8e45212bc2f67eae8c738a98680bad4b1ae52bb72f7d83ad2ee03ec24c16201e78d5fdb83b003acb88f713fae09e6ebb0b6cc609

Download Submit
memory/804-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/804-6-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download