Overview

overview

7

Static

static

1

2024-05-15...im.exe

windows7-x64

7

2024-05-15...im.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-05-15_33e33436077353eec09f1c1b1334a63a_darpapox_icedid_nymaim

  • Size

    4.8MB

  • Sample

    240515-e7k59shc71

  • MD5

    33e33436077353eec09f1c1b1334a63a

  • SHA1

    ee73dc9c027a8da7dbaebe61e58825b6bfae072b

  • SHA256

    753ecf33ae6143957617afd0d7c45d44bd81e2e8da94d00e7183a58c5d497ce9

  • SHA512

    6f8a2924274ece7e0ec18e9e3891718ecdfc008f4522ce400d36f3984399edb7c7984916f39a56ced6a04c85ad16c14de238f0f9f209d46dd39a064869489595

  • SSDEEP

    98304:YVSr/zGo4lUNS5+HSbrNbB21LVx1qjeIkUXLqxqYZCl6SxvWbrtUTrUHOr:OSrE2b2eIkUXLqxq/3x+NcIOr

Score
7/10
persistence

Malware Config

Targets

    • Target

      2024-05-15_33e33436077353eec09f1c1b1334a63a_darpapox_icedid_nymaim

    • Size

      4.8MB

    • MD5

      33e33436077353eec09f1c1b1334a63a

    • SHA1

      ee73dc9c027a8da7dbaebe61e58825b6bfae072b

    • SHA256

      753ecf33ae6143957617afd0d7c45d44bd81e2e8da94d00e7183a58c5d497ce9

    • SHA512

      6f8a2924274ece7e0ec18e9e3891718ecdfc008f4522ce400d36f3984399edb7c7984916f39a56ced6a04c85ad16c14de238f0f9f209d46dd39a064869489595

    • SSDEEP

      98304:YVSr/zGo4lUNS5+HSbrNbB21LVx1qjeIkUXLqxqYZCl6SxvWbrtUTrUHOr:OSrE2b2eIkUXLqxq/3x+NcIOr

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks