6d34cd7de5af007ffd5ae463621b0454e1116b5d9af1029b63de48f812bc7085

Analysis

max time kernel
136s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 10:12

Target

2024-04-25_83633268f54038fdcd09a532fe76e421_icedid_scarhikn.exe
Size

221KB
MD5

83633268f54038fdcd09a532fe76e421
SHA1

9ae537c5f93685e968b3c9e5618308144da04ef9
SHA256

6d34cd7de5af007ffd5ae463621b0454e1116b5d9af1029b63de48f812bc7085
SHA512

c7996a0997fafcb71bb01280f990ded84d5960b3ef43b2c785342baef6ba8b2137a1cfaa6070f13b8f18041828d738c8e0e211590d1c76faca5b32fe67e25605
SSDEEP

3072:KP95fwVjSH3MZ0YQRYrgWbdPpEe3f1C/q/CM4BoQF9nUYvQd2a:KP95Eq3MqYQugYf1CCwnza

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 4632	2752	2024-04-25_83633268f54038fdcd09a532fe76e421_icedid_scarhikn.exe	86
PID 2752 wrote to memory of 4632	2752	2024-04-25_83633268f54038fdcd09a532fe76e421_icedid_scarhikn.exe	86
PID 2752 wrote to memory of 4632	2752	2024-04-25_83633268f54038fdcd09a532fe76e421_icedid_scarhikn.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-04-25_83633268f54038fdcd09a532fe76e421_icedid_scarhikn.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-25_83633268f54038fdcd09a532fe76e421_icedid_scarhikn.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\yyyy.bat
  2⤵
  PID:4632

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\yyyy

Filesize
221KB

MD5
d46cb0184b226e1a49f4cc65242950ed

SHA1
0535a2c6f623293beb5c706f26bf2584938201ad

SHA256
d2e09d2882a5a5d2c755100b73d21de0e1513372392eb5ecc2074c2f07320d1a

SHA512
99af44a99d62c307b038fa122ab297b2ed86b574a07556e4ad6c6561a1d222d583b85cd56b96493a4f9ce556ab3e3ae53e484c37db31bf3d9e9b8b986c58e615

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyyy.bat

Filesize
337B

MD5
f0628c76595ba67cb62ab4979435af48

SHA1
7b28c9fc12343ab5588246577716c66db55bb14b

SHA256
7cf3702f137b77e031ae2f4e2bcdd201c4fbc0d61da9c7aa714176fda6a373a3

SHA512
3d61de031c90feaef8f8342a8e45212bc2f67eae8c738a98680bad4b1ae52bb72f7d83ad2ee03ec24c16201e78d5fdb83b003acb88f713fae09e6ebb0b6cc609

Download Submit
memory/2752-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2752-6-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download