Analysis
-
max time kernel
140s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 15:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe
Resource
win7-20240221-en
General
-
Target
2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe
-
Size
376KB
-
MD5
6c702d1cb3d79fc4b497098e05a70069
-
SHA1
918c043607a89bc4ae3a30cde386e71b2ea31389
-
SHA256
67caf35a0a9359a6f9514ecd1ed77aef7bab1f878ba74ad209a998e542ed967d
-
SHA512
2a3e7557e52b4b742ee04ff9143cfb34a915b653508de4cc466b789f36195929dc4bce21527000331d4ab68846fee72953acfeaea133afa09f50a7b2c3ad7236
-
SSDEEP
6144:rQla3R6yVQxPfT0ulhYlJzD2YQ/d4LyUH1iMfW6ezNtlGx4ROTu3Q:rQlah6yVmPfTjfYlJzD2YQ/dmyUViCeY
Malware Config
Extracted
emotet
Epoch2
190.108.228.62:8080
101.187.104.105:80
104.236.28.47:8080
46.105.131.87:80
195.244.215.206:80
50.35.17.13:80
78.186.5.109:443
60.250.78.22:443
209.97.168.52:8080
58.171.38.26:80
199.83.161.218:80
149.202.153.252:8080
173.21.26.90:80
104.236.246.93:8080
68.115.64.219:80
68.203.213.226:80
85.152.174.56:80
104.131.11.150:443
190.117.226.104:443
210.6.85.121:80
211.63.71.72:8080
200.85.110.240:8080
84.9.167.76:80
91.205.215.66:443
78.24.219.147:8080
139.130.242.43:80
182.71.222.187:80
50.116.86.205:8080
200.41.121.90:80
62.138.26.28:8080
37.187.72.193:8080
46.105.131.69:443
120.151.135.224:80
134.19.217.180:80
185.94.252.104:443
103.86.49.11:8080
210.56.10.58:80
37.210.228.23:80
104.131.44.150:8080
73.176.10.71:80
113.61.66.94:80
180.92.239.110:8080
104.32.141.43:80
190.160.53.126:80
80.102.134.174:8080
95.213.236.64:8080
177.230.81.0:22
101.187.134.207:8080
200.116.145.225:443
74.208.45.104:8080
62.75.141.82:80
61.197.37.169:80
113.160.130.116:8443
98.156.206.153:80
118.69.70.109:80
88.249.120.205:80
169.239.182.217:8080
37.139.21.175:8080
93.114.205.169:80
60.142.249.243:80
45.33.49.124:443
5.39.91.110:7080
185.155.20.82:80
24.179.13.119:80
59.148.227.190:80
212.174.19.87:80
174.57.150.13:8080
92.222.216.44:8080
60.130.173.117:80
201.236.135.104:443
5.88.27.67:8080
115.65.111.148:443
160.16.215.66:8080
136.243.205.112:7080
201.173.217.124:443
59.20.65.102:80
200.123.150.89:443
45.55.65.123:8080
80.11.158.65:8080
180.222.165.169:80
189.160.15.202:465
149.135.10.19:80
24.194.252.25:80
31.31.77.83:443
87.106.136.232:8080
5.196.74.210:8080
41.169.20.147:80
178.20.74.212:80
216.132.25.162:80
102.182.145.130:80
41.60.200.34:80
223.197.185.60:80
209.141.54.221:8080
107.184.91.187:80
93.51.50.171:8080
100.14.117.137:80
23.92.16.164:8080
54.39.187.202:443
168.235.67.138:7080
95.128.43.213:8080
213.243.211.114:80
190.55.181.54:443
186.176.228.2:80
217.145.83.44:80
190.114.244.182:443
24.94.237.248:80
112.68.240.21:80
91.231.166.124:8080
162.241.92.219:8080
186.208.123.210:443
110.145.77.103:80
176.9.43.37:8080
202.175.121.202:8443
42.200.191.247:80
98.15.140.226:80
31.172.240.91:8080
120.150.246.241:80
101.187.97.173:80
58.177.172.160:80
87.106.139.101:8080
62.75.187.192:8080
85.105.205.77:8080
78.189.165.52:8080
41.203.62.170:80
190.244.125.144:80
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
control.exepid process 2472 control.exe 2472 control.exe 2472 control.exe 2472 control.exe 2472 control.exe 2472 control.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exepid process 2256 2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.execontrol.exepid process 2256 2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe 2256 2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe 2472 control.exe 2472 control.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exedescription pid process target process PID 2256 wrote to memory of 2472 2256 2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe control.exe PID 2256 wrote to memory of 2472 2256 2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe control.exe PID 2256 wrote to memory of 2472 2256 2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe control.exe PID 2256 wrote to memory of 2472 2256 2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe control.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\control\control.exe"C:\Windows\SysWOW64\control\control.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2472