Overview

overview

7

Static

static

3

2024-04-04...id.exe

windows7-x64

7

2024-04-04...id.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/04/2024, 23:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-04_0adf4c19cdef23b9fe745baee5f630e2_icedid.exe

  • Size

    283KB

  • MD5

    0adf4c19cdef23b9fe745baee5f630e2

  • SHA1

    75d01c94ac428e96a8eda1c68541ba8739cb8d1b

  • SHA256

    8c82093ee7dd97c92122af41d8376261d25df82ddb2ed6a2dce8a00ba02e5ef4

  • SHA512

    50eb5d19e2dd4cded1444a3312dd5e27e2fc8526eb3721086bca8682e1f09ab9f1c6774d06b27ed6ec409344746a3c8be7cd4ca8ce0cfd8d38ebec0d164ab951

  • SSDEEP

    3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Program crash 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-04_0adf4c19cdef23b9fe745baee5f630e2_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-04_0adf4c19cdef23b9fe745baee5f630e2_icedid.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Program Files\.exe
      "C:\Program Files\\.exe" "33201"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3412
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 1048
      2⤵
      • Program crash
      PID:4384
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 1056
      2⤵
      • Program crash
      PID:3244
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1676 -ip 1676
    1⤵
      PID:1376
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1676 -ip 1676
      1⤵
        PID:2840

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files\.exe
              Filesize

              283KB

              MD5

              6b88f73dddd30ee6663b19b3d6960298

              SHA1

              c62d82dd0bf9bb7c2d26b241bab165150749ca4e

              SHA256

              0c90df8f5902d5b8b3c1c0753f86b71da723f27f5df269f24041f79fb8a38ecf

              SHA512

              9827369bd8ee3a40b162682ed3afbb8d64fd3d0617fef96897ee869ad7c4dab0a890d7d4d8b1144aa2e09f15e6ed3a4d5bed85d01da7a76b02932797c04159c8

              Download Submit