28394322c657ca821e241149715686909d4e4a07475df42385c07aad65006f38

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe
Size

700KB
MD5

3708bac5d6863d54766800809026dc7b
SHA1

fc6403e1415ff776bd6627e0ecd46dcf5683ddcc
SHA256

28394322c657ca821e241149715686909d4e4a07475df42385c07aad65006f38
SHA512

02db8e821bba57f2c74668a10bc89c387e8b61cf569cfe23affc49ef04c13482baf97d4f8ecc94ddbf7134d696960f3e020eedcbb9c5420fc0e3d6a72fe68959
SSDEEP

12288:hVn3OvVpoay/b227tMHn1obXHbGO9GCfqxv+T7y7+SHwRThQNSw:hVqRc7tMH1uXaMT7E+SK8X

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2508	1440	WerFault.exe	27
2612	2116	WerFault.exe	28

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1440	2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe
2116	2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2116	1440	2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe	28
PID 1440 wrote to memory of 2116	1440	2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe	28
PID 1440 wrote to memory of 2116	1440	2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe	28
PID 1440 wrote to memory of 2116	1440	2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe	28
PID 1440 wrote to memory of 2508	1440	2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe	29
PID 1440 wrote to memory of 2508	1440	2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe	29
PID 1440 wrote to memory of 2508	1440	2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe	29
PID 1440 wrote to memory of 2508	1440	2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe	29
PID 2116 wrote to memory of 2612	2116	2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe	30
PID 2116 wrote to memory of 2612	2116	2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe	30
PID 2116 wrote to memory of 2612	2116	2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe	30
PID 2116 wrote to memory of 2612	2116	2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Users\Admin\AppData\Local\Temp\2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-03-26_3708bac5d6863d54766800809026dc7b_icedid.exe" /watch
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 440
    3⤵
    - Program crash
    PID:2612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 736
  2⤵
  - Program crash
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\54634578.log

Filesize
40B

MD5
85ab0fb99ee569fcc5bae67fde77b694

SHA1
78a87b7b7a088c4932ebd1c3f4d55347be07de72

SHA256
67f37beada98e4b69d27326f8d12f2c457a7c309cf6c8536e4e8b05aa749b61c

SHA512
e4e06c16f2ec22deb4fe919f88f6b9ff2699f418a41b00e35a46f147dfff4d9b210517f747f88683474f82b2b5ce6d006e17be42efb10b019daa8d83e844e42a

Download Submit