Resubmissions

25-06-2024 09:32

240625-lhmq5avdkn 8

25-04-2024 08:56

240425-kwgllahc6w 8

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    25-04-2024 08:56

General

  • Target

    2024-04-25_d9d449c9c6d368b233f49ed97e9c3c8c_icedid.exe

  • Size

    3.9MB

  • MD5

    d9d449c9c6d368b233f49ed97e9c3c8c

  • SHA1

    fb09d733d91cc965e7703524bcd716d94f731165

  • SHA256

    367014af705e434195983d5afda943f89237030559430b40c868b09835cf3497

  • SHA512

    88cf5bbabdc2191170c0a6dbb5466a63a8678ae8ec3f81f0f5191924ddd9f23089c6019bc86a74140033a29e2579fcb4fbc523cf02d39d24947355158eae5fff

  • SSDEEP

    49152:QoRg5x6c1PoU/1oGbnQ/7WUT9B5k1YCdptya507NUUWn043oHS3fTZYwVq1/xT3u:He5x6c1PouojNhS9Yw8y

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-25_d9d449c9c6d368b233f49ed97e9c3c8c_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-25_d9d449c9c6d368b233f49ed97e9c3c8c_icedid.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1148

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\Uninstall.exe
    Filesize

    3.9MB

    MD5

    ca5312ea36d0227997bdded85610e273

    SHA1

    b3065d2be1af7575a549cf12a4a0cf8c8d622fc9

    SHA256

    91025228a3bcd1d1ed1556692adfb07665b5875b38eae3221d81a785a4911628

    SHA512

    ad80b7e9dc3200f87b1ccd4c08fde13a36a01ce9ddabf7e3277dec0464270977f1a65f163f752ca534fe5c275e79db99bdfa4afecaec8b2e669c72d9aec7efff