Analysis
-
max time kernel
92s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20-03-2024 00:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-20_8aa72e8a07ec938788ce0195acd2a89b_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-20_8aa72e8a07ec938788ce0195acd2a89b_icedid.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-03-20_8aa72e8a07ec938788ce0195acd2a89b_icedid.exe
-
Size
427KB
-
MD5
8aa72e8a07ec938788ce0195acd2a89b
-
SHA1
c94d13dba73995715cbae654b545d2a9dd00c873
-
SHA256
d5a2300a7513d550b41bbc614a5c064e7080679650810722f425dc114e36c019
-
SHA512
dccdfdb43a2885b1653f432640b8b21541b6db0ddb5f851fecc358369cb45b18eb0e50a71274432797e1dd267cfd3ab2e87667307b97ac547425a73561620c02
-
SSDEEP
12288:jplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:lxRQ+Fucuvm0as
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4928 managed.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\requires\managed.exe 2024-03-20_8aa72e8a07ec938788ce0195acd2a89b_icedid.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2420 2024-03-20_8aa72e8a07ec938788ce0195acd2a89b_icedid.exe 2420 2024-03-20_8aa72e8a07ec938788ce0195acd2a89b_icedid.exe 2420 2024-03-20_8aa72e8a07ec938788ce0195acd2a89b_icedid.exe 2420 2024-03-20_8aa72e8a07ec938788ce0195acd2a89b_icedid.exe 4928 managed.exe 4928 managed.exe 4928 managed.exe 4928 managed.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2420 wrote to memory of 4928 2420 2024-03-20_8aa72e8a07ec938788ce0195acd2a89b_icedid.exe 85 PID 2420 wrote to memory of 4928 2420 2024-03-20_8aa72e8a07ec938788ce0195acd2a89b_icedid.exe 85 PID 2420 wrote to memory of 4928 2420 2024-03-20_8aa72e8a07ec938788ce0195acd2a89b_icedid.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-20_8aa72e8a07ec938788ce0195acd2a89b_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-20_8aa72e8a07ec938788ce0195acd2a89b_icedid.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Program Files\requires\managed.exe"C:\Program Files\requires\managed.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4928
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
427KB
MD5c358958cdec0a79daa1e14e50c40779e
SHA1901da303739c6e5a2b1eda5eff1cff2a3ceb4ab2
SHA256da705ae73b2a0e3312277c3bfa637b6168f852607bff3dab1999bffcd756c003
SHA512441fc077ede99083bc64617f0128a4ca2b7f42cffb128c733d3e2868bd5e2fc1b42206d9301f7f7df256ddd7e96308833d35d4deea42f21ec6a143ced08cec75