da4c4bffb2ee9d7f68e3ed31af82b0b9f40f09956d5fdaa256f217afd7ac3787

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 20:09 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe
Size

2.3MB
MD5

59c0ac791aa6dadbdc7ed8ae2156d61e
SHA1

87db6ce7586a1632aafd91c1b193c2eafa43229f
SHA256

da4c4bffb2ee9d7f68e3ed31af82b0b9f40f09956d5fdaa256f217afd7ac3787
SHA512

4e6473a42f4dca659fa550f69feecf31a5f88a0d45c8aeb10e8b76fce2ab35d078c77c0476812cff586a002842f4ee87aef715955ccb599f2dda8697006c2a32
SSDEEP

49152:K3Mzz9JpLKwhvFY9A8/KVtoKArx+KOw9xV1XL4Is6OBNPJd02K:eMzz9JhKyFY9A8/KVtaDOw9xV1XJs5Bh

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3116	F6C.tmp

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\msvcr120.dll	F6C.tmp
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	F6C.tmp
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll	F6C.tmp
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll	F6C.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	F6C.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\mfc140u.dll	F6C.tmp
File opened for modification	C:\Program Files\7-Zip\7z.sfx	F6C.tmp
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	F6C.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\concrt140.dll	F6C.tmp

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4156	2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe
4156	2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4156	2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe
4156	2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4156	2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe
4156	2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe
4156	2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 3116	4156	2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe	91
PID 4156 wrote to memory of 3116	4156	2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe	91
PID 4156 wrote to memory of 3116	4156	2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Users\Admin\AppData\Local\Temp\F6C.tmp
  C:\Users\Admin\AppData\Local\Temp\F6C.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3804 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:924

Network

DNS

0.205.248.87.in-addr.arpa

Remote address:

8.8.8.8:53

Request

0.205.248.87.in-addr.arpa

IN PTR

Response

0.205.248.87.in-addr.arpa

IN PTR

https-87-248-205-0lgwllnwnet
DNS

217.106.137.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

217.106.137.52.in-addr.arpa

IN PTR

Response
DNS

14.160.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.160.190.20.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

26.165.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.165.165.52.in-addr.arpa

IN PTR

Response
DNS

56.126.166.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

56.126.166.20.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

240.221.184.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.221.184.93.in-addr.arpa

IN PTR

Response
DNS

13.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.227.111.52.in-addr.arpa

IN PTR

Response
DNS

123.10.44.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

123.10.44.20.in-addr.arpa

IN PTR

Response

13.107.246.64:443

46 B
40 B
1
1

8.8.8.8:53

0.205.248.87.in-addr.arpa

dns

71 B
116 B
1
1

DNS Request

0.205.248.87.in-addr.arpa
8.8.8.8:53

217.106.137.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

217.106.137.52.in-addr.arpa
8.8.8.8:53

14.160.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

14.160.190.20.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

26.165.165.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

26.165.165.52.in-addr.arpa
8.8.8.8:53

56.126.166.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

56.126.166.20.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

240.221.184.93.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

240.221.184.93.in-addr.arpa
8.8.8.8:53

13.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

13.227.111.52.in-addr.arpa
8.8.8.8:53

123.10.44.20.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

123.10.44.20.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\F6C.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
memory/4156-0-0x0000000002490000-0x000000000251E000-memory.dmp

Filesize
568KB

Download
memory/4156-1-0x0000000002490000-0x000000000251E000-memory.dmp

Filesize
568KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.