Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-06-2024 06:54

General

  • Target

    2024-06-01_eda003529d345bc85a17007bb16f0067_hacktools_icedid.exe

  • Size

    14.9MB

  • MD5

    eda003529d345bc85a17007bb16f0067

  • SHA1

    adae703a498c801b9f1049ad033c03a222ceffa0

  • SHA256

    ebd5939290a2946497913a77976229c0aea2cc4c40889f534cea4a4ff6bd8f33

  • SHA512

    16dcb0512896365f6eef9140c313ca12ef37b1140665811643dc03f70faed235deb91f3fa7484d0a0a741b31fdd4a599e6b1c13f4b817e22a3a7b875b2f7c81e

  • SSDEEP

    393216:NfAxnRtzgTthToLokxW2gg9wnpBItAf1r:tAxnRiprHFgoItAfR

Score
9/10

Malware Config

Signatures

  • Detects executables packed with VMProtect. 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-01_eda003529d345bc85a17007bb16f0067_hacktools_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-01_eda003529d345bc85a17007bb16f0067_hacktools_icedid.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ÌìÁúСÃÛ\ÔËÐÐÎļþ\QYCJ.dll

    Filesize

    3.0MB

    MD5

    54da9cb20347baec926b6678f8efb3ab

    SHA1

    18ca10861aa561c56666270cca7fd44c73c28d72

    SHA256

    038675d5ee0b22a17a12646ba9cf3fcffd0a2acfb712c1953102671774a82390

    SHA512

    e4608ef1875e2dd46c1352d5e750178ce439725a6b190d37a14decb7e960428841ea3ef5e17488226f9bcfc6d58793cb254f142ba4f54cd316c9cbee50cae77b

  • C:\ÌìÁúСÃÛ\ÔËÐÐÎļþ\SoftXLic.ini

    Filesize

    550B

    MD5

    56fd23a70c535e1ab980c79d20f0c78c

    SHA1

    88f094f639359f181539677a6ba68428f8487877

    SHA256

    d2b50a72cc4ecf2937c57f00c82e0d1586e8e0682cce28f56706928d4fafee7d

    SHA512

    6da2dc08d5d97057af450a63cdcb9809d68363f946e598a3f1921e47112324f97806b651a65b1c70d79821dc08921764f665fa767545b8b83994d7e28edcee29

  • memory/4772-28-0x0000000005DE0000-0x000000000642C000-memory.dmp

    Filesize

    6.3MB

  • memory/4772-27-0x0000000003270000-0x0000000003271000-memory.dmp

    Filesize

    4KB

  • memory/4772-30-0x0000000005E51000-0x000000000612C000-memory.dmp

    Filesize

    2.9MB

  • memory/4772-31-0x0000000005DE0000-0x000000000642C000-memory.dmp

    Filesize

    6.3MB

  • memory/4772-40-0x0000000005E51000-0x000000000612C000-memory.dmp

    Filesize

    2.9MB

  • memory/4772-41-0x0000000005DE0000-0x000000000642C000-memory.dmp

    Filesize

    6.3MB