Overview

overview

7

Static

static

3

2024-03-25...id.exe

windows7-x64

7

2024-03-25...id.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/03/2024, 16:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-03-25_61ff33456ed3b24695a2c46c3dc97cda_icedid.exe

  • Size

    390KB

  • MD5

    61ff33456ed3b24695a2c46c3dc97cda

  • SHA1

    5c2761e5de6f1fa8bfd3b280fbcb3f594b1d865a

  • SHA256

    9d44ef089752998f70ce3957fd8624984e7ca2d85dc8dd9176704a92578156fa

  • SHA512

    8eff7c4592b6b80d912065afee7b087308a3721bc11a91d8a0c0dce26a5558a6d151b4764cb54fdec7dd44f8da0ea24fbbae851319f15f3627830ad1c581a3b3

  • SSDEEP

    12288:wplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:MxRQ+Fucuvm0as

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-25_61ff33456ed3b24695a2c46c3dc97cda_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-25_61ff33456ed3b24695a2c46c3dc97cda_icedid.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1376
    • C:\Program Files\AutoPlay\Naming.exe
      "C:\Program Files\AutoPlay\Naming.exe" "33201"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:836
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4192 --field-trial-handle=2252,i,3429015581403167983,2708022432612919502,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3972

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\AutoPlay\Naming.exe
            Filesize

            390KB

            MD5

            4aeb882cf2272b444ad6393d956e8544

            SHA1

            60919b371d973465a4d8f5f42b50c091b5fdd71f

            SHA256

            85b5da1cad9917f893dfc7658b5a16ebaef416060cc7d1cac717f32557fd24ff

            SHA512

            32ba713b14801578c39f3eb07e31036c22f317be9ae3bab8c5ed3b82ecc86d5d7459c3c9f41f10484af799ef5e7c891ae66646f4414b06411f2a87831e73bacc

            Download Submit