f2ab90a75d77b341f329fa0fd3934c2d33c01982f632f03eb977ee01e134afc1

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-26_c2814d587e40ed29947bedf7f9e176e7_icedid_scarhikn.exe
Size

209KB
MD5

c2814d587e40ed29947bedf7f9e176e7
SHA1

47c71d553497942feffef9fc4da772a77f223b16
SHA256

f2ab90a75d77b341f329fa0fd3934c2d33c01982f632f03eb977ee01e134afc1
SHA512

f78e7bb885ed4adce5e0b7314885c9c95c8b1ce255410389066a09ca6e038e9e611b5d8cdbe378de48833e8df4ad9d7a0d30ab5072cf3aa79690b650d883e8e2
SSDEEP

3072:FP95fwVjSH3MZ0YQRYrgWbNPpEe3f1C/q/CM4BoQF9nTYvQd2a:FP95Eq3MqYQugIf1CCwnka

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 5028	4108	2024-03-26_c2814d587e40ed29947bedf7f9e176e7_icedid_scarhikn.exe	91
PID 4108 wrote to memory of 5028	4108	2024-03-26_c2814d587e40ed29947bedf7f9e176e7_icedid_scarhikn.exe	91
PID 4108 wrote to memory of 5028	4108	2024-03-26_c2814d587e40ed29947bedf7f9e176e7_icedid_scarhikn.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-03-26_c2814d587e40ed29947bedf7f9e176e7_icedid_scarhikn.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-26_c2814d587e40ed29947bedf7f9e176e7_icedid_scarhikn.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\yyyy.bat
  2⤵
  PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yyyy

Filesize
209KB

MD5
c8d8dc023b9bac5f9506f96393312d76

SHA1
2b15c9ce7814482f13ab511c54313c2e113470d7

SHA256
15d8641b14ca8e072a0b9f18f62ef0533df60db0dd501d173507babc6201d990

SHA512
f9e7bb53a3f4d93487fe3410bf5f9d6d881f4969a3b09e1ad46eb63d1150e8b5413d429c1633998534b8acef3d98f3132cafc2215f9ad4f0f9e6cea3fefb214d

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyyy.bat

Filesize
337B

MD5
f0628c76595ba67cb62ab4979435af48

SHA1
7b28c9fc12343ab5588246577716c66db55bb14b

SHA256
7cf3702f137b77e031ae2f4e2bcdd201c4fbc0d61da9c7aa714176fda6a373a3

SHA512
3d61de031c90feaef8f8342a8e45212bc2f67eae8c738a98680bad4b1ae52bb72f7d83ad2ee03ec24c16201e78d5fdb83b003acb88f713fae09e6ebb0b6cc609

Download Submit