Analysis
-
max time kernel
130s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
23/05/2024, 20:10
General
-
Target
2024-05-23_b5388e7213104dc97d21ea81520d7858_icedid.exe
-
Size
15.9MB
-
MD5
b5388e7213104dc97d21ea81520d7858
-
SHA1
903b0b111c26e49a6b68b6602748fe2de38ae693
-
SHA256
bafc25d1cfeeb2f24fc502de8701ce379f1e2ff8e117b6f4b8a5b82c390b495b
-
SHA512
ee22611d6ed44883978fa8360ec3e64ee1355ebe770c9f6189e6e380d22e9ec892373a30b0aed72adf8be3d031fc31bd45cc2d1b6cf19c2afd65ab9d50ea840f
-
SSDEEP
196608:INMvM/Qchb/JZqfermDbQD9Z+uv9v14EOmc7zUF8:sD/QMBryQDPv995Ot7
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_b5388e7213104dc97d21ea81520d7858_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_b5388e7213104dc97d21ea81520d7858_icedid.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\13357.exe"C:\Users\Admin\AppData\Local\Temp\13357.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15.1MB
MD5667f75e62527430ed222ebb8c6449fc7
SHA11ccb27d7030c20508531555aa3af14dc91babf9e
SHA2564d1235f9e83ab04e4698b05e9eb21a960bac0f2f68f444e428197faf2790c671
SHA512d7a077f48866f2085c3581b931133d0c7bd27dff4e87a60b2041223e402c9f3d5c5cd1f3014109c60dc97e58faaa14ef9730ab49daa951485f34d9b060262067