Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
06/06/2024, 21:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe
Resource
win7-20240508-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe
-
Size
2.1MB
-
MD5
e710e54986bc079efb9a7c68a63bd070
-
SHA1
4fa98d40f34228735cafe15c81b6b98f4f74c860
-
SHA256
f24bc7d71858ed98f0023feb73ce57a9a43edfbffebce08d9304bc99b48a333b
-
SHA512
d5c9e4be2160daa6846df38b9561a27e7671aff15543e549fed154c6738d925fc1ccf4dfdcb066df16617c57a99723ecb207b6ac5185d829486096fec698ea8b
-
SSDEEP
49152:BPdxdDgtkg/PQnRPySPtfZSBFUDtoH8lbYC9pB2kK/xyBvgXP2KbAF:tdxatkg/PQRPPfSBFUptlbYC9pB2vZqP
Score
1/10
Malware Config
Signatures
-
Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ftarc\shell\open\command 2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ftarc\shell 2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FTGateArchive.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe,0" 2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FTGateArchive.Document 2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FTGateArchive.Document\ 2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FTGateArchive.Document\shell 2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FTGateArchive.Document\shell\open 2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FTGateArchive.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe \"%1\"" 2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ftarc 2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ftarc\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe \"%1\"" 2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ftarc\DefaultIcon 2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FTGateArchive.Document\DefaultIcon 2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FTGateArchive.Document\shell\open\command 2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ftarc\ = "FTGateArchive.Document" 2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ftarc\shell\open 2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ftarc\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe,0" 2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2984 2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe 2984 2024-06-06_e710e54986bc079efb9a7c68a63bd070_icedid.exe