9ebe65374e1a44cec6fb8ab36023efdff58d81a65cf8bba26eebaeff9b234e89

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 08:41

Target

2024-03-19_276266112d65e71f916201a1beda0324_icedid.exe
Size

283KB
MD5

276266112d65e71f916201a1beda0324
SHA1

f4d3c7501145726ce67cd7b62502c7e8150c30f5
SHA256

9ebe65374e1a44cec6fb8ab36023efdff58d81a65cf8bba26eebaeff9b234e89
SHA512

1e74a2ca227b9bd684b0fb9f3085b7e2e22ab601e19c957ba1d3be34dbf86c8b6e04d73ca8c751f54d8f92849ce96b2732006b1645611d99cdeb15d5abd46753
SSDEEP

3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3692	Sample.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\GetDXVer\Sample.exe	2024-03-19_276266112d65e71f916201a1beda0324_icedid.exe
File opened for modification	C:\Program Files\GetDXVer\Sample.exe	2024-03-19_276266112d65e71f916201a1beda0324_icedid.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1920	2028	WerFault.exe	87
4228	2028	WerFault.exe	87

Suspicious use of SetWindowsHookEx 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 3692	2028	2024-03-19_276266112d65e71f916201a1beda0324_icedid.exe	89
PID 2028 wrote to memory of 3692	2028	2024-03-19_276266112d65e71f916201a1beda0324_icedid.exe	89
PID 2028 wrote to memory of 3692	2028	2024-03-19_276266112d65e71f916201a1beda0324_icedid.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-03-19_276266112d65e71f916201a1beda0324_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-19_276266112d65e71f916201a1beda0324_icedid.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files\GetDXVer\Sample.exe
  "C:\Program Files\GetDXVer\Sample.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 1012
  2⤵
  - Program crash
  PID:1920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 1044
  2⤵
  - Program crash
  PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2028 -ip 2028
1⤵
PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2028 -ip 2028
1⤵
PID:3260

C:\Program Files\GetDXVer\Sample.exe

Filesize
283KB

MD5
d8809be63ef220357c9d3dbe65a0123f

SHA1
e8af0f98fae17f1c73d33f800fc24316ea64e416

SHA256
07dfdf00d827058d33fd7ecadb3de04e89b340b0c712212bfdf7a1fab73ce7c3

SHA512
7b3e7a2121ed3b14d2980ed2ecc7f27fc38ca29e3c2dd288f45daedbe7f94131dae8351ce1771ed244fb12af7d748c226a153bceb3104227f162506a04d3f826

Download Submit