75b75b411ac17dbc98355e9363b66f90d79e28d2d8a6001937cbdc870105a397

Analysis

max time kernel
115s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 05:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-09_0f353cfb03712c3b3102ca66f3c5a57f_icedid_scarhikn.exe
Size

209KB
MD5

0f353cfb03712c3b3102ca66f3c5a57f
SHA1

4138364d2ec292d641b20a684dfb409ce80d011c
SHA256

75b75b411ac17dbc98355e9363b66f90d79e28d2d8a6001937cbdc870105a397
SHA512

3285dba5bcff94e2403b90961c9456df4728392cf4535b14b9c730b2f99c58fc7e9602361357a02b99cb690b2f7e02e965acb09e44d54f2845efb969ed913fd9
SSDEEP

3072:CP95fwVjSH3MZ0YQRYrgWbNPpEe3f1C/q/CM4BoQF9nTYvQd2a:CP95Eq3MqYQugIf1CCwnka

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 3144	2804	2024-04-09_0f353cfb03712c3b3102ca66f3c5a57f_icedid_scarhikn.exe	94
PID 2804 wrote to memory of 3144	2804	2024-04-09_0f353cfb03712c3b3102ca66f3c5a57f_icedid_scarhikn.exe	94
PID 2804 wrote to memory of 3144	2804	2024-04-09_0f353cfb03712c3b3102ca66f3c5a57f_icedid_scarhikn.exe	94

C:\Users\Admin\AppData\Local\Temp\2024-04-09_0f353cfb03712c3b3102ca66f3c5a57f_icedid_scarhikn.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-09_0f353cfb03712c3b3102ca66f3c5a57f_icedid_scarhikn.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\yyyy.bat
  2⤵
  PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=3044,i,17059189006398306756,4247826696353232857,262144 --variations-seed-version /prefetch:8
1⤵
PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yyyy

Filesize
209KB

MD5
4d96010f09097881fab15903b058460a

SHA1
d1dd64a2d66bf6ac24b16b0b6bbcd42d093b53c0

SHA256
f68b109ad03f962aeee4a6c7f0c07e2954360f4e3b7c910e800e091bf155f144

SHA512
31da2dd8b87ff42ba0d90681abfaf1099b41f81129955c095fd34ac31af0456071a87bd96d94906462b7859e7c1555fdaa3c0861d4689abbdc08bbb9bfb2a6c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyyy.bat

Filesize
337B

MD5
f0628c76595ba67cb62ab4979435af48

SHA1
7b28c9fc12343ab5588246577716c66db55bb14b

SHA256
7cf3702f137b77e031ae2f4e2bcdd201c4fbc0d61da9c7aa714176fda6a373a3

SHA512
3d61de031c90feaef8f8342a8e45212bc2f67eae8c738a98680bad4b1ae52bb72f7d83ad2ee03ec24c16201e78d5fdb83b003acb88f713fae09e6ebb0b6cc609

Download Submit