9eed00bc2e3c9ac68a3eb7c95978f7b4d9db606af5635f9adf4610505ee230c5

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-25_c1c016d4c8700539de8613bb24ded099_cobalt-strike_icedid.exe
Size

686KB
MD5

c1c016d4c8700539de8613bb24ded099
SHA1

efb460b691c6d460b3960a5f1dc33b8abe1c1f0e
SHA256

9eed00bc2e3c9ac68a3eb7c95978f7b4d9db606af5635f9adf4610505ee230c5
SHA512

82c26baaef41af218804581455752619948babed65cce5ff69e99877688bd338f03d11755bee846907091ffb403cfe53eb5fb92efc187856b69ad8d01750ac4c
SSDEEP

12288:wBRxnqlRXW3psLJ/legGL7myTo4FJReN4rWUa5hyEq1r:yRkTxLJ/ogGL7Fo40lUaHyEq1r

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	2024-03-25_c1c016d4c8700539de8613bb24ded099_cobalt-strike_icedid.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2024-03-25_c1c016d4c8700539de8613bb24ded099_cobalt-strike_icedid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	2024-03-25_c1c016d4c8700539de8613bb24ded099_cobalt-strike_icedid.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2936	2024-03-25_c1c016d4c8700539de8613bb24ded099_cobalt-strike_icedid.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2936	2024-03-25_c1c016d4c8700539de8613bb24ded099_cobalt-strike_icedid.exe
2936	2024-03-25_c1c016d4c8700539de8613bb24ded099_cobalt-strike_icedid.exe

C:\Users\Admin\AppData\Local\Temp\2024-03-25_c1c016d4c8700539de8613bb24ded099_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-25_c1c016d4c8700539de8613bb24ded099_cobalt-strike_icedid.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2024-03-25_c1c016d4c8700539de8613bb24ded099_cobalt-strike_icedid.ini

Filesize
46B

MD5
99e90c9241a0fe211ca55223fa3888a5

SHA1
a64f3623533a984518db1070691597a8f10212db

SHA256
053a980c2e514f9d291c7d70faf163121bad433deda571d4ee9062976b1a4c84

SHA512
43a2f2c8cbf4d94804fddf2f5f8108dc94abfba5baa29d325a93858b3c9d20c6b3484091fefb6d0f078f5d9b5b38c81621a04169a3ae15999d13f7a44cfa5079

Download Submit