Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19/03/2024, 20:03
General
-
Target
2024-03-19_34ecf1778be97a77d7d5f97ed7fab4c7_icedid.exe
-
Size
5.0MB
-
MD5
34ecf1778be97a77d7d5f97ed7fab4c7
-
SHA1
19c0e3e539ba11b28ba11c340fcce0035f4bbab6
-
SHA256
e6b3dd968205b3fbe67c5a316776a5c239ed75f2c3494090c94e55cf58c0ac96
-
SHA512
abe48d9991d569a746a4c03a75dc94af8413b78d5a9d4769adea4d916fe4f92d42c905775bb0ee3358b92c4cb7441dfb72855ed745e2c93f3eb00d3d01f8a8b4
-
SSDEEP
98304:0eyxOT2yYv9eaHzRInuOBfKLpj3DK0d/HkANIeatvqEgG5Dw7:0s2QalInuLNDJd/9N6MGq7
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_34ecf1778be97a77d7d5f97ed7fab4c7_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_34ecf1778be97a77d7d5f97ed7fab4c7_icedid.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MS¸üÐÂÆ÷.exeC:\Users\Admin\AppData\Local\Temp\MS¸üÐÂÆ÷.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\rar.exe"C:\Program Files\rar.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD576982a06a2dc02dbaec9fbdc8880f05c
SHA18062066a4817afeabbf766728611c83c8d99fc69
SHA256b1a2b3ef0cb9beca15ecae7393e0a4d591fa2268a1bde4a11ae56489a90001e2
SHA512f2221b89d3914175451be7f2396c7c229c79f22c8f9ee79db96fe3816fca26fa63ec7f0ca3be807f3c47b64cda43a049c7cd4aacbee4aa674f6a684dec2c9d38
-
Filesize
2.1MB
MD595e2e7e288216119da43132ff3766cc1
SHA1e46c0478dfedd51fa1d2422f936c83c926186519
SHA256e643ae3135c538ae34e256d874663e16708f6649ea3e785c5bfe2da575a2d752
SHA5124be6bd21ec935e42e66be26d4881c4ae1e19da5356654a1e6fe29a5dd1630abdf8148f86cd2ae3c7ad123b9e9c6acfe74adaea2b58e22024d653795a336fd374
-
Filesize
2.2MB
MD5948d456f17d82eecb845e94035b78289
SHA14c4d86575c98de176a4516765d0e3d6442f187b5
SHA256e5032ce40350fa298c2881b298101e2b94dfd0c68cf314d42a40c58d5e61efa0
SHA512a0bf0130ca384a58161b863454a63d8d441d7b2ac67e3da1da4d0d00fdb22030927e04f51858c12ef578ea570f1e95f7f8e614f13a4d0a91617d680c06fbab95
-
Filesize
934KB
MD59057a8715449b66929851a2c6017801b
SHA1df578272bb95b47da8b9be6f8ca1682b3195719b
SHA256a18892e0c300cf31451fbf651196924e5ff71a35c42ee08c3bc1231782de39bf
SHA512843a73c603db07e52e4e0101f8eba11bec7c0b0da1770b4974fa27016f08a4ff7c5835a58736ebc0b60dff2f547046af1651a0aeeae003be06242a6d8d872526
-
Filesize
689KB
MD5519350a3125ec21bad5799dcf280648f
SHA11e0294405ef860b7df46313ee0421fa3647a29e1
SHA25614f20230225bded9c85d6f82ca3f98a6a126038e4f9c6523302fcc2ec62a8fb4
SHA51228cee3ae54eb14dfffc27ea12c205341cd1ed67fbb4e6cf63e3906c8f5fcef5f049011bb7060ff1adb854d1e8969adf0cf458f98ff28231d3c4ae0c90ee0b905
-
Filesize
60KB