2efa1014025fa45fdf508a7422c6aaa136c6c5138e656209fd038b3290691b36

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 19:12

Target
2024-06-13_c4b866731ad264e23d5b301686ce40cf_icedid.exe
Size 291KB
Sample240613-xwf2aasdpm
SHA256 2efa1014025fa45fdf508a7422c6aaa136c6c5138e656209fd038b3290691b36
MD5 c4b866731ad264e23d5b301686ce40cf
SHA1 8c4d6944b64d233288dc9ac7ce614958403b3dc2
SHA512 6a4d02a7aa1c9a032ab3b30da3946b9177c2ab56e32780053017b9a37c64edd939853c698d6806b82b76977de9fdb1fae5b0311c1bf22a4942ebb9f7b8d4a3f1
SSDEEP 3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
892	dependant.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\distribution\dependant.exe	2024-06-13_c4b866731ad264e23d5b301686ce40cf_icedid.exe
File opened for modification	C:\Program Files\distribution\dependant.exe	2024-06-13_c4b866731ad264e23d5b301686ce40cf_icedid.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3436	3140	WerFault.exe	81
3068	3140	WerFault.exe	81

Suspicious use of SetWindowsHookEx 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 892	3140	2024-06-13_c4b866731ad264e23d5b301686ce40cf_icedid.exe	82
PID 3140 wrote to memory of 892	3140	2024-06-13_c4b866731ad264e23d5b301686ce40cf_icedid.exe	82
PID 3140 wrote to memory of 892	3140	2024-06-13_c4b866731ad264e23d5b301686ce40cf_icedid.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-06-13_c4b866731ad264e23d5b301686ce40cf_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-13_c4b866731ad264e23d5b301686ce40cf_icedid.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Program Files\distribution\dependant.exe
  "C:\Program Files\distribution\dependant.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 1052
  2⤵
  - Program crash
  PID:3436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 1060
  2⤵
  - Program crash
  PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3140 -ip 3140
1⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3140 -ip 3140
1⤵
PID:644

dependant.exe

Path C:\Program Files\distribution\dependant.exe
Size 291KB
SHA256 3fedf02ff73f136381619888235d84ee2c4d4caf4e8826c31c1fb15d00bf71a8
MD5 c0bf9fb117a63d8f637cf6f3f63e50ac
SHA1 adaed1973d174ef5921643a35c8dcfe5f1f9c4db
SHA512 4736a967d7e8c788600a27c1f0886329dd3d99af72d4d6343bbc6799748a573e2de7520643e78530c33045d429e76342bfadf90732d43f99e35084f5fc48e807
SSDEEP 3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x
MD5 SHA1 SHA512 SSDEEP

Submit Download