Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-04-2024 09:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-01_7added706284b583067cce950419e560_icedid.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
2024-04-01_7added706284b583067cce950419e560_icedid.exe
-
Size
3.1MB
-
MD5
7added706284b583067cce950419e560
-
SHA1
23b854a47420bbe6ad19616eb594edd0cd65a734
-
SHA256
c9c31aa87520742c070852f2197d41847df2906c3b63b94547af837140ba88ed
-
SHA512
336a7a1d6d8b0012bc7bf7ae38dca6656319bb1332cf9bd561705841945aa22ac69be6889ea8af4755b1bb94568005ecc88465826470b609690b5ced1f7a0ac5
-
SSDEEP
98304:UbPR0leq5gXtFxlH56Y+PdBN0rAf3sKDWMLmV0DC+:ER0lelD4BtmV0Dp
Malware Config
Signatures
-
Raccoon Stealer V2 payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2272-12-0x0000000000DD0000-0x0000000000DE6000-memory.dmp family_raccoon_v2 -
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2272-12-0x0000000000DD0000-0x0000000000DE6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4248 2272 WerFault.exe 2024-04-01_7added706284b583067cce950419e560_icedid.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2024-04-01_7added706284b583067cce950419e560_icedid.exepid process 2272 2024-04-01_7added706284b583067cce950419e560_icedid.exe 2272 2024-04-01_7added706284b583067cce950419e560_icedid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-01_7added706284b583067cce950419e560_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-01_7added706284b583067cce950419e560_icedid.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2272 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 5402⤵
- Program crash
PID:4248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2272 -ip 22721⤵PID:876