Overview

overview

7

Static

static

3

2024-04-22...id.exe

windows7-x64

7

2024-04-22...id.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/04/2024, 14:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-22_c5a5e6852ea5ce3155b3ce2a256ef631_icedid.exe

  • Size

    421KB

  • MD5

    c5a5e6852ea5ce3155b3ce2a256ef631

  • SHA1

    48a69ccc8fd7b1beed5208027c21433690db4e3f

  • SHA256

    3da5994184cd81e88b2a51430604372b3680ca170ed3405cc5529bec11719f14

  • SHA512

    8edb9f7fdc4d4bf3e014ee59f83ffcbf17e1e2e72c2c83ba57c6e16554d78f32f2056285b36d58009f057f3a46cec1e8d90f632f917eaa1b295617695abd6353

  • SSDEEP

    12288:VplrVbDdQaqdS/ofraFErH8uB2Wm0SX/Nr5FU:HxRQ+Fucuvm0a/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-22_c5a5e6852ea5ce3155b3ce2a256ef631_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-22_c5a5e6852ea5ce3155b3ce2a256ef631_icedid.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Program Files\Dinstall\Follow.exe
      "C:\Program Files\Dinstall\Follow.exe" "33201"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3520
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4172

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\Dinstall\Follow.exe
            Filesize

            421KB

            MD5

            f81b7d6fba9650faa70af2820ce67121

            SHA1

            5b5d8f4fbe08e646f007928ef1e7a1a1c44c37e6

            SHA256

            a63a1a46cb42f103fce825e2114fc3091acde1009ed6d2cc4e27a7e085b14527

            SHA512

            c478518649ce261e74754f927e85c8dff7e191a66553e7b3b11fba260914b08d26db8f36fa958c6894a9ef20368137c3bd3ed6d57f6a781064894f8d778fd4cc

            Download Submit

          • memory/2220-0-0x0000000000400000-0x0000000000573000-memory.dmp

            Filesize

            1.4MB

            Download

          • memory/2220-6-0x0000000000400000-0x0000000000573000-memory.dmp

            Filesize

            1.4MB

            Download

          • memory/3520-5-0x0000000000400000-0x0000000000573000-memory.dmp

            Filesize

            1.4MB

            Download

          • memory/3520-7-0x0000000000400000-0x0000000000573000-memory.dmp

            Filesize

            1.4MB

            Download