Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23/05/2024, 09:50
General
-
Target
2024-05-23_37ddb1725921119a0dfb07cb1d06edf7_icedid.exe
-
Size
772KB
-
MD5
37ddb1725921119a0dfb07cb1d06edf7
-
SHA1
2f6512f1b9fedcc7c9d28ad895c908e7c2ac9b0d
-
SHA256
14d65f9f77904d6e34193be84dc03c5ccbb6413bf892dfe5ca6b30bb727e302a
-
SHA512
cd925367b7264cfeaa3c97e9f067513c7e8e7d68c4f6a28901b1d4c5d0e39258c4dcca0152457d2042d9ae19d2edbd197e311d25836113f9e7c02e76306f6a1a
-
SSDEEP
12288:3+ZPWJ2G7I4eb/R1RPBE414fpnSexor/goVkfNzIqJCQ1E1xpdBGvrXw:3+4J2R/R1RP4SR/OfFIqJCQUGj
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_37ddb1725921119a0dfb07cb1d06edf7_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_37ddb1725921119a0dfb07cb1d06edf7_icedid.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Wegame\dzus8pZ.exe"C:\Program Files (x86)\Wegame\dzus8pZ.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1009KB
MD5dad71cf712373ed84ddbf2771733b4e8
SHA1593a8152253d66b2631618d4e83508a6427b2521
SHA256b4cfa149077ca06bf8151f65ff154ab1560c4a5f265cc6fff0d651c532acb836
SHA512910c64e0308ec29ec05265b176912b0048f9a0dee1c14d1d26ac5259f1421896538d9642e7e7d992e617bbfa01829292810f93c1169b317343075c737a6de733
-
Filesize
556KB
MD5f2fa7879faa4b732675ff265d3da6fc0
SHA1b9a5074f0d86efa0cdacb4214c1fe66a41b8525e
SHA2568c7506b772bbfd534f20280af36564fb4ae95c8708a2f95d471ed607ccf65272
SHA5125020d0403fe3d30570843cc8b08b76e7b3fbaa3a706293125dfdc6c60ee42536f90b753f2536068c87f850d96b14a9030392144b0561966b7a223055d38908c1
-
Filesize
152KB
-
Filesize
4.0MB