4caeac0e90031fb94844dce3b7cf21f523c49e8a8b6a4989ded6bdb7fdf3a7be

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 02:36

Target

2024-03-14_c1b443bd3040175cad552d7145ee5378_icedid.exe
Size

21.4MB
MD5

c1b443bd3040175cad552d7145ee5378
SHA1

ef9aa902ff9de9866e98ec6f164f6e7b6b6c18cf
SHA256

4caeac0e90031fb94844dce3b7cf21f523c49e8a8b6a4989ded6bdb7fdf3a7be
SHA512

b183181f079ae25575a2d100afac3356a6efaf1a34a3bf2ff4e2017b80445b3a441e8b8326c2af706d38c7d2108fc497ffc681654a124025114aadeb2439667c
SSDEEP

393216:4uKb1BdUDwfmc93dKF82FGDToyu+RMhX6Gl4Qku6qSvpzwm59bTl6imTRNbNtR:4Zb1Bdvr3IFGPru+RjETicm3Plm1NbfR

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1164	2024-03-14_c1b443bd3040175cad552d7145ee5378_icedid.exe
1164	2024-03-14_c1b443bd3040175cad552d7145ee5378_icedid.exe

C:\Users\Admin\AppData\Local\Temp\2024-03-14_c1b443bd3040175cad552d7145ee5378_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-14_c1b443bd3040175cad552d7145ee5378_icedid.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1164

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact