Overview

overview

7

Static

static

3

2024-05-23...id.exe

windows7-x64

7

2024-05-23...id.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    23-05-2024 00:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-23_ebca202de1aeb57174c67e9be148e554_icedid.exe

  • Size

    719KB

  • MD5

    ebca202de1aeb57174c67e9be148e554

  • SHA1

    2eb6cc9ccde433d3928f265d34e85dc40b8987a2

  • SHA256

    85ba02d12eee2b5beafeac548abe0e76bf182eea8c421416252fab1c7796d8d1

  • SHA512

    7c8b3de52f0fc439e6fd63103041ecd2f0faaa4f0961556b68d729388b950ea43d54ec3e8bba2fad5174c17808f2f71d66ed6536c71f68d16a9a601b413e237c

  • SSDEEP

    12288:MQt46f2XX3hG7qixwAsJW4gVj26oFkjlxYWkcZDEgsDp/dvdQWIaw:MQF3FsJW12jkjlxtkwogsDFdvdd

Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-23_ebca202de1aeb57174c67e9be148e554_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-23_ebca202de1aeb57174c67e9be148e554_icedid.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Users\Admin\AppData\Local\Temp\2B45.tmp
      C:\Users\Admin\AppData\Local\Temp\2B45.tmp
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      PID:2136

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
    Filesize

    148B

    MD5

    bd30a0c8fadbfeb4ca7d05ba8a6b2806

    SHA1

    a1da0906396be862b4936b1181d1de4c93fa08fe

    SHA256

    4cb426f8f08a778bbd50d7368bf0c5d9c3edc9086d8e307b8f367fe04882aad2

    SHA512

    5968b2922d4aa5d888181d296a80fdafecc3f989d80d84962937aca150d815a22d13bad4fc4aa2ad831ce1f38ea5cb6def34226356c11e1f9358204890c96744

    Download Submit
  • \Users\Admin\AppData\Local\Temp\2B45.tmp
    Filesize

    145KB

    MD5

    c610e7ccd6859872c585b2a85d7dc992

    SHA1

    362b3d4b72e3add687c209c79b500b7c6a246d46

    SHA256

    14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

    SHA512

    8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

    Download Submit
  • memory/1220-1-0x0000000000260000-0x00000000002AE000-memory.dmp
    Filesize

    312KB

    Download