Overview

overview

7

Static

static

3

2024-03-28...id.exe

windows7-x64

7

2024-03-28...id.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    138s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2024 00:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-03-28_6cfcf82c446a105dc158771fd075da92_icedid.exe

  • Size

    385KB

  • MD5

    6cfcf82c446a105dc158771fd075da92

  • SHA1

    a817ca4d6018dd90738e183ceca1ef43fb0aac7d

  • SHA256

    0b61586140f52992534256716a9145dacfb596787871cc032d0ff3badf6f8ac6

  • SHA512

    d938bb49672459c840037389562a2d5f6e74b53ca9f5528fa3b11502e538fe47497cc191a55f4d3fab4380b6115b1472dff96f27c9fe614fb949ba829349cb66

  • SSDEEP

    12288:2plrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:SxRQ+Fucuvm0as

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-28_6cfcf82c446a105dc158771fd075da92_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-28_6cfcf82c446a105dc158771fd075da92_icedid.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3528
    • C:\Program Files\points\root.exe
      "C:\Program Files\points\root.exe" "33201"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3172
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4768

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\points\root.exe
      Filesize

      385KB

      MD5

      450307ebea77ad3cc0c0bbc8502a1601

      SHA1

      da76ea6a06762dda700150e3c0865fbc3a413229

      SHA256

      90b31d9de7bb89ce81fba4e05c246402ec06a941518ad44cf8165fba957e981b

      SHA512

      ad288944727c58ba3846235ebd8608876272f51ee6c423d063aa693368aa3133f1340dc9fa5d73509c4212b2a8e7a3194a4dd8207e03f7ef6cfb773c994521f5

      Download Submit