Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
31/05/2024, 10:42
General
-
Target
2024-05-31_e28cb3a2c902ae4c57bd028a0aaa5173_hacktools_icedid.exe
-
Size
19.9MB
-
MD5
e28cb3a2c902ae4c57bd028a0aaa5173
-
SHA1
ce8672e095f57ca09353c8e696c968afdb34fedd
-
SHA256
5c3663bd8ff5707f2f0320454d50836cccf86662e8efc8e807867024ee203c26
-
SHA512
f931b6327a7cf50e623a026f80405f261b93d8c513f2d7a929e9122aacc49a029555d8dbff03cf3a7d8418fcea8f38c808e62be0768999c862f7277e75b34c4c
-
SSDEEP
393216:PxPGY64yEM7TOCKjcThkIRWwE2r6KWq5Wqj:pqEc6UhDx6KWq5Wqj
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_e28cb3a2c902ae4c57bd028a0aaa5173_hacktools_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_e28cb3a2c902ae4c57bd028a0aaa5173_hacktools_icedid.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5c091a823c41bb5bc6c5a1ab6c926504c
SHA17b358a9211f8f5e3ce22f38075caf605fc4d2032
SHA256c58334cb8bd8e7a2c998d0717fff8bacbd873ab949e40a0e5f053dd51b67cca4
SHA512742ea0c78115f602c16a793d6d34ea97f0ff8bd4fc1ab28b90b7b7a3dc6fe6b921615ce97c0b23839e18f632d8e09f4319052de532dd9d31b70a22f12b7cc68d