Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22-04-2024 13:36
General
-
Target
2024-04-22_fb60c9a89bb0869d35bde2ab55ac918c_icedid.exe
-
Size
391KB
-
MD5
fb60c9a89bb0869d35bde2ab55ac918c
-
SHA1
af8a4a55b8df090c4f9e17764e7dc0d87f5cd1ea
-
SHA256
daa95576d13d3929139d9d49637ac0cc53938eb24580785fd61eb5f9a1d2ec49
-
SHA512
cddebe529adb7ff2ad4fcf957239d6f757f013eed0a52d7413525817102be305f244e828113f5218c6459b8d3e37902a0b54bbc3b6c5f29b4f4a31be5917f843
-
SSDEEP
12288:RplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:jxRQ+Fucuvm0as
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-22_fb60c9a89bb0869d35bde2ab55ac918c_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-22_fb60c9a89bb0869d35bde2ab55ac918c_icedid.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\contained\agreements.exe"C:\Program Files\contained\agreements.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
391KB
MD5525160b3c0ebf957afdf1c50729b4036
SHA13c7068ee1c18aa860b080fbae5fb656347766979
SHA25642f5a7b6873a6b2f03e1091f1a9ace20d1dfced01c97785ecb835584a69d4222
SHA5124e3a94eca48c2c39c3b35b99685aa3b7e5a797400572309b23ae266ab572e934d92028db4ee206c29bd39118233d37dd79219af4efccb4b39b213b247ba32a78