Overview

overview

7

Static

static

3

2024-06-16...id.exe

windows7-x64

7

2024-06-16...id.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    131s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    16/06/2024, 20:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-16_99545d7d7e092bec8105e3f391a95a24_icedid.exe

  • Size

    2.3MB

  • MD5

    99545d7d7e092bec8105e3f391a95a24

  • SHA1

    1292abd9ba0094cd015aafe976f6e437cfa82ee1

  • SHA256

    29134cde0760ac5374894a15d3550cb7486c565a9ce4bb4f04e1b2ac2ee989c8

  • SHA512

    53b929b5c878e3e7821c4b6451dce441f7998d1d183e8c26e6b9c2b885ce300c259183b13a9cb02c5845a30b9324c3f476fae1da16de8f2178e838c563caa020

  • SSDEEP

    49152:RuDgn/joi7sTWKKQ88rAoB8HicamzQ8fxV1XP41g612cms2P:EDgn/joEsZKQ88rAoB8Hev8fxV1XSg6e

Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-16_99545d7d7e092bec8105e3f391a95a24_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-16_99545d7d7e092bec8105e3f391a95a24_icedid.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1876
    • C:\Users\Admin\AppData\Local\Temp\D69.tmp
      C:\Users\Admin\AppData\Local\Temp\D69.tmp
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      PID:2364

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\D69.tmp
          Filesize

          145KB

          MD5

          c610e7ccd6859872c585b2a85d7dc992

          SHA1

          362b3d4b72e3add687c209c79b500b7c6a246d46

          SHA256

          14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

          SHA512

          8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

          Download Submit

        • memory/1876-0-0x0000000002160000-0x00000000021F1000-memory.dmp

          Filesize

          580KB

          Download

        • memory/1876-1-0x0000000002160000-0x00000000021F1000-memory.dmp

          Filesize

          580KB

          Download