Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
19/03/2024, 20:03
General
-
Target
2024-03-19_34ecf1778be97a77d7d5f97ed7fab4c7_icedid.exe
-
Size
5.0MB
-
MD5
34ecf1778be97a77d7d5f97ed7fab4c7
-
SHA1
19c0e3e539ba11b28ba11c340fcce0035f4bbab6
-
SHA256
e6b3dd968205b3fbe67c5a316776a5c239ed75f2c3494090c94e55cf58c0ac96
-
SHA512
abe48d9991d569a746a4c03a75dc94af8413b78d5a9d4769adea4d916fe4f92d42c905775bb0ee3358b92c4cb7441dfb72855ed745e2c93f3eb00d3d01f8a8b4
-
SSDEEP
98304:0eyxOT2yYv9eaHzRInuOBfKLpj3DK0d/HkANIeatvqEgG5Dw7:0s2QalInuLNDJd/9N6MGq7
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_34ecf1778be97a77d7d5f97ed7fab4c7_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_34ecf1778be97a77d7d5f97ed7fab4c7_icedid.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MS¸üÐÂÆ÷.exeC:\Users\Admin\AppData\Local\Temp\MS¸üÐÂÆ÷.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\rar.exe"C:\Program Files\rar.exe"3⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
839KB
MD56278004b663de081a6595975f606dc2f
SHA134c161e9ef0fc7b7a6911f4d898d895e31ede95d
SHA256dd5bed095baf2db16173b198f1368ebaa7dbb8c2c68d357e119c12bd23bfd83a
SHA512c755898d278a9edcb8934c17dd50ae664e621313881279dad44ff8975a3be4f2f45d87febff0257f36e4fa7e5c92efb2a94651d491541e109b0ec949acd10e4d
-
Filesize
477KB
MD5ff32b720442d2981bfa70368a4d85244
SHA14658dd2931eb18e9cece2d086e10468a864aff88
SHA2562e256ec88dd97d1c65ed2a2ed87d3487b890ee9c6e0ef47db6d00017ec2ef6a8
SHA5127ba3de8e2076b18ba828b03043397ebc83d09ef928e428eced2d611c70497c695db2ccf8c8c336a92b1bbebf6c789f8bd84c197feb822a382d89e044bed1410b
-
Filesize
3.2MB
MD53eff7f815f3be26eb59751f75ac840e1
SHA14eed14d1feedb31eb07c296a1d7494e63cb6dac2
SHA2565eaf565e86da11e27d863df0e7e98a8cde13cdbe1adde4e532a9786cbf1da3e0
SHA512f1133e8a97728c1880ed57a28cdc92449acde3faf03ce4a5b7129729c19de0b70baccfec4fdf4bd4c41e75733bfed112336ab28b67b1bbe4c4cedbf5fd9646a6
-
Filesize
3.9MB
MD567de76fd634e9302c309864d9fc37136
SHA1593dadfc12cb7458466d42fb457f87485d02eaa4
SHA25646c2015167d6bfab87f68b0da9d47f379950a4187d5afdb0d587b6b1a2e1d108
SHA512998965351cca76f716609bb035106449d56ef3df605beb13c2c589aac1554b77cd2ac911c2d02efcb798a59df332303b0054f9d462f19aa7f99c52baa69ddbc4
-
Filesize
896KB
MD5e98976f4033a89fb667e4e0beb35477e
SHA106072399d811c33329f4665cfb98110e449b3784
SHA25657b410b4ebafe42d768c4a24e19e67aa32e1e5b4a391098327140850093527b3
SHA512ee971faf39871280b2692a232ae5afbbfaafd16b51ec354c4f166f72b7a8ecad6a8f19e087bbc6105b894720c78d6a44384d54bf397429a471e2c4d20ed5336b
-
Filesize
3.1MB
MD576982a06a2dc02dbaec9fbdc8880f05c
SHA18062066a4817afeabbf766728611c83c8d99fc69
SHA256b1a2b3ef0cb9beca15ecae7393e0a4d591fa2268a1bde4a11ae56489a90001e2
SHA512f2221b89d3914175451be7f2396c7c229c79f22c8f9ee79db96fe3816fca26fa63ec7f0ca3be807f3c47b64cda43a049c7cd4aacbee4aa674f6a684dec2c9d38
-
Filesize
3.4MB
MD532bc1b78126b1986a420a69abae8d38b
SHA1b1cf4c39b641f5a1f1cdc188109c97d5daba9063
SHA25610e55bb4ac0596a98097ea928f4b8d38bab91a47d5f45cef1862dfff2036be0a
SHA512ad87515ef39e526248d41523040aebd4b19e194b0ca2330a469734ab689ad90a6714fe012313a345db2b800d0947b5cd64a86a86407fe708f4a6465d4a39697f
-
Filesize
3.6MB
MD5d3187435116ce0689f50b38dbced5b95
SHA147664e2ac4405244bd1c420e345b0b0d7e893229
SHA25691fef6e2b86c443c72cdf72bbd80ceec38c49123dcf9d4755df0d011d734829d
SHA512fbcff87c75560f534191d296306c71c20efbe3978714d9dca1403927432a3d93aaa472df40953d9f72551b86f97a855101856edb31b4d6853b135246acf69bbc
-
Filesize
60KB