Analysis
-
max time kernel
138s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 15:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe
Resource
win7-20240221-en
General
-
Target
2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe
-
Size
376KB
-
MD5
6c702d1cb3d79fc4b497098e05a70069
-
SHA1
918c043607a89bc4ae3a30cde386e71b2ea31389
-
SHA256
67caf35a0a9359a6f9514ecd1ed77aef7bab1f878ba74ad209a998e542ed967d
-
SHA512
2a3e7557e52b4b742ee04ff9143cfb34a915b653508de4cc466b789f36195929dc4bce21527000331d4ab68846fee72953acfeaea133afa09f50a7b2c3ad7236
-
SSDEEP
6144:rQla3R6yVQxPfT0ulhYlJzD2YQ/d4LyUH1iMfW6ezNtlGx4ROTu3Q:rQlah6yVmPfTjfYlJzD2YQ/dmyUViCeY
Malware Config
Extracted
emotet
Epoch2
190.108.228.62:8080
101.187.104.105:80
104.236.28.47:8080
46.105.131.87:80
195.244.215.206:80
50.35.17.13:80
78.186.5.109:443
60.250.78.22:443
209.97.168.52:8080
58.171.38.26:80
199.83.161.218:80
149.202.153.252:8080
173.21.26.90:80
104.236.246.93:8080
68.115.64.219:80
68.203.213.226:80
85.152.174.56:80
104.131.11.150:443
190.117.226.104:443
210.6.85.121:80
211.63.71.72:8080
200.85.110.240:8080
84.9.167.76:80
91.205.215.66:443
78.24.219.147:8080
139.130.242.43:80
182.71.222.187:80
50.116.86.205:8080
200.41.121.90:80
62.138.26.28:8080
37.187.72.193:8080
46.105.131.69:443
120.151.135.224:80
134.19.217.180:80
185.94.252.104:443
103.86.49.11:8080
210.56.10.58:80
37.210.228.23:80
104.131.44.150:8080
73.176.10.71:80
113.61.66.94:80
180.92.239.110:8080
104.32.141.43:80
190.160.53.126:80
80.102.134.174:8080
95.213.236.64:8080
177.230.81.0:22
101.187.134.207:8080
200.116.145.225:443
74.208.45.104:8080
62.75.141.82:80
61.197.37.169:80
113.160.130.116:8443
98.156.206.153:80
118.69.70.109:80
88.249.120.205:80
169.239.182.217:8080
37.139.21.175:8080
93.114.205.169:80
60.142.249.243:80
45.33.49.124:443
5.39.91.110:7080
185.155.20.82:80
24.179.13.119:80
59.148.227.190:80
212.174.19.87:80
174.57.150.13:8080
92.222.216.44:8080
60.130.173.117:80
201.236.135.104:443
5.88.27.67:8080
115.65.111.148:443
160.16.215.66:8080
136.243.205.112:7080
201.173.217.124:443
59.20.65.102:80
200.123.150.89:443
45.55.65.123:8080
80.11.158.65:8080
180.222.165.169:80
189.160.15.202:465
149.135.10.19:80
24.194.252.25:80
31.31.77.83:443
87.106.136.232:8080
5.196.74.210:8080
41.169.20.147:80
178.20.74.212:80
216.132.25.162:80
102.182.145.130:80
41.60.200.34:80
223.197.185.60:80
209.141.54.221:8080
107.184.91.187:80
93.51.50.171:8080
100.14.117.137:80
23.92.16.164:8080
54.39.187.202:443
168.235.67.138:7080
95.128.43.213:8080
213.243.211.114:80
190.55.181.54:443
186.176.228.2:80
217.145.83.44:80
190.114.244.182:443
24.94.237.248:80
112.68.240.21:80
91.231.166.124:8080
162.241.92.219:8080
186.208.123.210:443
110.145.77.103:80
176.9.43.37:8080
202.175.121.202:8443
42.200.191.247:80
98.15.140.226:80
31.172.240.91:8080
120.150.246.241:80
101.187.97.173:80
58.177.172.160:80
87.106.139.101:8080
62.75.187.192:8080
85.105.205.77:8080
78.189.165.52:8080
41.203.62.170:80
190.244.125.144:80
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
fde.exepid process 2532 fde.exe 2532 fde.exe 2532 fde.exe 2532 fde.exe 2532 fde.exe 2532 fde.exe 2532 fde.exe 2532 fde.exe 2532 fde.exe 2532 fde.exe 2532 fde.exe 2532 fde.exe 2532 fde.exe 2532 fde.exe 2532 fde.exe 2532 fde.exe 2532 fde.exe 2532 fde.exe 2532 fde.exe 2532 fde.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exepid process 3956 2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exefde.exepid process 3956 2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe 3956 2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe 2532 fde.exe 2532 fde.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exedescription pid process target process PID 3956 wrote to memory of 2532 3956 2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe fde.exe PID 3956 wrote to memory of 2532 3956 2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe fde.exe PID 3956 wrote to memory of 2532 3956 2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe fde.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_6c702d1cb3d79fc4b497098e05a70069_icedid.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\fde\fde.exe"C:\Windows\SysWOW64\fde\fde.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2532