Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2024, 14:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-28_c4cb0902eda2767ed9def853265975bd_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-28_c4cb0902eda2767ed9def853265975bd_icedid.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-28_c4cb0902eda2767ed9def853265975bd_icedid.exe
-
Size
389KB
-
MD5
c4cb0902eda2767ed9def853265975bd
-
SHA1
04f88d89ed4551a9e6e6747d1e85eae614cd45ef
-
SHA256
df78f595bf2144167b97b5b118c6de0d60498e17fae86aa9c57b7a376dee9f19
-
SHA512
3b792865a31fd04a70f14d9e44b47909511fcc35827685a87ed655a4d5138fdbcd5b021da9ae097b3f947db6159c5988069c05f5e86dc21dabfd123fa8d044b5
-
SSDEEP
12288:BplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:TxRQ+Fucuvm0as
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4812 indicator.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Update\indicator.exe 2024-03-28_c4cb0902eda2767ed9def853265975bd_icedid.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2160 2024-03-28_c4cb0902eda2767ed9def853265975bd_icedid.exe 2160 2024-03-28_c4cb0902eda2767ed9def853265975bd_icedid.exe 2160 2024-03-28_c4cb0902eda2767ed9def853265975bd_icedid.exe 2160 2024-03-28_c4cb0902eda2767ed9def853265975bd_icedid.exe 4812 indicator.exe 4812 indicator.exe 4812 indicator.exe 4812 indicator.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2160 wrote to memory of 4812 2160 2024-03-28_c4cb0902eda2767ed9def853265975bd_icedid.exe 86 PID 2160 wrote to memory of 4812 2160 2024-03-28_c4cb0902eda2767ed9def853265975bd_icedid.exe 86 PID 2160 wrote to memory of 4812 2160 2024-03-28_c4cb0902eda2767ed9def853265975bd_icedid.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_c4cb0902eda2767ed9def853265975bd_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-28_c4cb0902eda2767ed9def853265975bd_icedid.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Program Files\Update\indicator.exe"C:\Program Files\Update\indicator.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4812
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
390KB
MD50526ffac672e0cc309a36afc8175edb4
SHA1bfb511373b1eb397ea8e4e75bb9823d9599efeb0
SHA25690c3ba0401a73c8fbb6bbcfefbfcd2c6694bc0309ad810e2c2c1eb391a2c36b1
SHA512c75f92f08f8f95874589e56762f4823266380ed0b7285d7ae07cedeb040746ac99a0d23c488b6b49ec988e3c82654dd0833f290520cb45b66020e4ca3cd86456