3912a457ba895ef0bae43214682eb2d6cab4f8773fe88b6900fdc3fd1577164b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-27_f8fae80e608518a91037d75eab11d14c_icedid_scarhikn.exe
Size

209KB
MD5

f8fae80e608518a91037d75eab11d14c
SHA1

6801710bd4a4a660e82d63ad39994db8b3695841
SHA256

3912a457ba895ef0bae43214682eb2d6cab4f8773fe88b6900fdc3fd1577164b
SHA512

58f2552a93f76260459cc9bb63d11dc1717c84fe8145dd58cabcd9dedf06bfe4e8c24c7ecaec46c84861b3d9e2a1f13825074af38678dc05871b3b12340c4c4a
SSDEEP

3072:lP95fwVjSH3MZ0YQRYrgWbNPpEe3f1C/q/CM4BoQF9nTYvQd2a:lP95Eq3MqYQugIf1CCwnka

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1908	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1908	2844	2024-04-27_f8fae80e608518a91037d75eab11d14c_icedid_scarhikn.exe	28
PID 2844 wrote to memory of 1908	2844	2024-04-27_f8fae80e608518a91037d75eab11d14c_icedid_scarhikn.exe	28
PID 2844 wrote to memory of 1908	2844	2024-04-27_f8fae80e608518a91037d75eab11d14c_icedid_scarhikn.exe	28
PID 2844 wrote to memory of 1908	2844	2024-04-27_f8fae80e608518a91037d75eab11d14c_icedid_scarhikn.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-27_f8fae80e608518a91037d75eab11d14c_icedid_scarhikn.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-27_f8fae80e608518a91037d75eab11d14c_icedid_scarhikn.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\yyyy.bat
  2⤵
  - Deletes itself
  PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yyyy

Filesize
209KB

MD5
a6811cfabf976af2d5ffffe904e43ece

SHA1
554b57e77e5c39477f616246a09208ca9f7e1d39

SHA256
d182e11773bebf8f7b392acb75e9a4e5dfccd23be9c3820f85071da88d88365c

SHA512
a6c2336ee4f64b590710efa3ee5fd3b5e68de98a6b02286d2563a2aeae99bbbc383e25347530343aa81fda6d82300f9fb6cda84847d6ea2f7e31283ade15432f

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyyy.bat

Filesize
337B

MD5
f0628c76595ba67cb62ab4979435af48

SHA1
7b28c9fc12343ab5588246577716c66db55bb14b

SHA256
7cf3702f137b77e031ae2f4e2bcdd201c4fbc0d61da9c7aa714176fda6a373a3

SHA512
3d61de031c90feaef8f8342a8e45212bc2f67eae8c738a98680bad4b1ae52bb72f7d83ad2ee03ec24c16201e78d5fdb83b003acb88f713fae09e6ebb0b6cc609

Download Submit