24437b93c5ba5578f14824a404c54400ccb874ee21a79219af8709947499c10b

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-22_18200a705e99d44625158a9ed22f959c_icedid_scarhikn.exe
Size

221KB
MD5

18200a705e99d44625158a9ed22f959c
SHA1

3b3fb32d107aa41d1a6cf49c4f9ad86175f30171
SHA256

24437b93c5ba5578f14824a404c54400ccb874ee21a79219af8709947499c10b
SHA512

ca5e19011971515f58b3dbe465fa537c0e42f7f84c39e55bcbc291b50936b31b16af3fa70e485705f96e97fa5421364e8ee3ed91b58f0ac48439134767b7bf0f
SSDEEP

3072:cP95fwVjSH3MZ0YQRYrg4bNPpEe3f1C/q/CM4BoQF9nVYvQd2a:cP95Eq3MqYQugqf1CCwn6a

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2520	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2520	2988	2024-04-22_18200a705e99d44625158a9ed22f959c_icedid_scarhikn.exe	28
PID 2988 wrote to memory of 2520	2988	2024-04-22_18200a705e99d44625158a9ed22f959c_icedid_scarhikn.exe	28
PID 2988 wrote to memory of 2520	2988	2024-04-22_18200a705e99d44625158a9ed22f959c_icedid_scarhikn.exe	28
PID 2988 wrote to memory of 2520	2988	2024-04-22_18200a705e99d44625158a9ed22f959c_icedid_scarhikn.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-22_18200a705e99d44625158a9ed22f959c_icedid_scarhikn.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-22_18200a705e99d44625158a9ed22f959c_icedid_scarhikn.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\yyyy.bat
  2⤵
  - Deletes itself
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yyyy

Filesize
221KB

MD5
12acd930d66bdd3dd8dec95824a0ad49

SHA1
d6834b3e10cc3b20e5aab7a6d75b55f51008ed11

SHA256
e8ba59c328d9d791a2838fe3c329f72e2ff930dbbb241523484f6a50109edeb9

SHA512
6cfe4dca78dfb894fd9ff0b190e8746fc07b418dde817f6110f951acc8747b2fcf39ff7080bf560f9629d315010bc7c75711f33ea8f9c36883aecde8dd406474

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyyy.bat

Filesize
337B

MD5
f0628c76595ba67cb62ab4979435af48

SHA1
7b28c9fc12343ab5588246577716c66db55bb14b

SHA256
7cf3702f137b77e031ae2f4e2bcdd201c4fbc0d61da9c7aa714176fda6a373a3

SHA512
3d61de031c90feaef8f8342a8e45212bc2f67eae8c738a98680bad4b1ae52bb72f7d83ad2ee03ec24c16201e78d5fdb83b003acb88f713fae09e6ebb0b6cc609

Download Submit
memory/2988-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2988-11-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download