Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27-03-2024 19:50
General
-
Target
2024-03-27_4eafd8d984cb2caa056f5b6eba69a86c_icedid.exe
-
Size
419KB
-
MD5
4eafd8d984cb2caa056f5b6eba69a86c
-
SHA1
9a52396b06585d38d3b85c4e7cdf8386769bb5f2
-
SHA256
16ffd7605a89a8d1627f57a524417b77233451821b2f11e9b15c05511fe91a55
-
SHA512
3c6deddcf012d7d9190437bf19bf50faa92f6bfd244c817e1cd01d44797c4d8ff1c5b7ad8ee2b872dbf85acd5a254982eed7c3d298c870df4ee092e68d1c9423
-
SSDEEP
12288:VplrVbDdQaqdS/ofraFErH8uB2Wm0SX/Nr5FU:HxRQ+Fucuvm0a/
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-27_4eafd8d984cb2caa056f5b6eba69a86c_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-27_4eafd8d984cb2caa056f5b6eba69a86c_icedid.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\obtained\Employ.exe"C:\Program Files\obtained\Employ.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
419KB
MD58f82dc2c1def9814153f2c05f1d44666
SHA1636fdbaa6f80c41f8eff4ccb5cf9ac67c3267285
SHA2562c9afe40b5e5716c1a9f79758b1e49f56d99d817ffdd1f8ae94aa9cc41397f51
SHA512a7f08d52843520e622c482c570ba852e4f174ce8e757b0e1322dd638f8ba3e4494d1d494db6337731926571ce73387a78d434342591441f5f19f4069ae80c77d
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB