Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
27/03/2024, 18:26
General
-
Target
2024-03-27_890ccdd953ad624f557516c5f94ef5ec_icedid.exe
-
Size
2.0MB
-
MD5
890ccdd953ad624f557516c5f94ef5ec
-
SHA1
0137cd95c0cfbb4ea2659253b13f781a980914c0
-
SHA256
d61b83ccbe8a440efc227f483a6a67000d7fb671b4c38227a2068fa4e5528e23
-
SHA512
c7ce61f6ebb9b77d0ea5e63be869b9528e34d3c8add9ee34464d1f8f12b7f8a92d9a27fe3d3bbe70d680040f0fab909efdfb7e3e72425db2390d96c80616b11a
-
SSDEEP
49152:vnsHyjtk2MYC5GDuTq24GjdGS9hWb2J3Y2p9tGk5fA:vnsmtk2aeEjdGSGb2Jo2b75fA
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 8 IoCs
-
Detects executables (downlaoders) containing URLs to raw contents of a paste 8 IoCs
-
Detects executables Discord URL observed in first stage droppers 8 IoCs
-
Detects executables manipulated with Fody 8 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-27_890ccdd953ad624f557516c5f94ef5ec_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-27_890ccdd953ad624f557516c5f94ef5ec_icedid.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_2024-03-27_890ccdd953ad624f557516c5f94ef5ec_icedid.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2024-03-27_890ccdd953ad624f557516c5f94ef5ec_icedid.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 16883⤵
- Program crash
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 16844⤵
- Program crash
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4924 -ip 49241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 444 -ip 4441⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD5d4eb82a1d0c7985f2c4f5a0178d9a5e1
SHA158bf51386cc471e90d7e6e217774c2b93c17c95e
SHA2560bbf51a3de754fac2e26c9df7ea5d458f115918282d114eb6a52a481df33a2ea
SHA512a8ac9d665d4324c605efeddf42b29963e0688fc321d61ddec43ad336e31bbb98b44d98c2caa763f0f8742930bc6ef52eccb32f6551b2dcb8cf38494f57afcb5b
-
Filesize
1.6MB
MD5b47fee981e848287c2edb597fae2b804
SHA1c9d21a6182caa3d442b636a62b35a0a87a07d900
SHA256c1a81dde828b44224606933875b3cf4b0bc494742e17968c389bf1d8e15e8a20
SHA5127414e39207efcf7105498e6e30209448718470dc28c7c50ac6fce735c0754fafa8127977abc641bcff05cff88ed4251916b69e9a16781d3c492a7f3d5b8de62f
-
Filesize
2.0MB
MD5890ccdd953ad624f557516c5f94ef5ec
SHA10137cd95c0cfbb4ea2659253b13f781a980914c0
SHA256d61b83ccbe8a440efc227f483a6a67000d7fb671b4c38227a2068fa4e5528e23
SHA512c7ce61f6ebb9b77d0ea5e63be869b9528e34d3c8add9ee34464d1f8f12b7f8a92d9a27fe3d3bbe70d680040f0fab909efdfb7e3e72425db2390d96c80616b11a
-
Filesize
1.2MB
MD5c0ea55286540db56bee76d56ccb295bc
SHA1c7c63f6ffab5925ba9c7d9f9e4f7b494bc00eb68
SHA256310739bba1cf863d2d54e2fa15a48f3163dd2eee9839c70db4cd4aa435da44fa
SHA512e8ca1f979d329cd7cd4a6bd46fcf5abbebac3dad138c8cd751489751dccccd8eea092161fe8130b59d3cdd5cfa724bb59f7178a70c3fe62a6557be763c419c37
-
Filesize
153B
MD593f58e7229530ad2b22774f170a2f581
SHA1ad0112b8a300283d645b2070f15c58777688154f
SHA256aa7f10c8d0eca33b326ebb1f41f160fc59c04dbc60fac4c150e32c466181689d
SHA5123bce7f38886bf105e1fcf21b04a320c69f62ead7026958e7e7c2144b6fb9dc0b002b52f5a2fbafc681926a42e68528ddf39c8e218112724345a5129d35dd2c24
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
1.2MB
-
Filesize
7.7MB
-
Filesize
112KB
-
Filesize
72KB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
152KB
-
Filesize
680KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB