dfb42d89ec2ece769e73bac78089e99cc751622c57b66ff2ede41c5bef5ba772

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/08/2024, 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-08_1806ae04d79a8c39fdca0954699600c8_icedid.exe
Size

282KB
MD5

1806ae04d79a8c39fdca0954699600c8
SHA1

8846e8fc0f9e28786fb03dbcc89698fff4ff7a06
SHA256

dfb42d89ec2ece769e73bac78089e99cc751622c57b66ff2ede41c5bef5ba772
SHA512

c53b8dfe25797025499ec74eebc6538e24db61b39c4dac96f248f2459f3d267c1f3dfc090af340a5ab3a4e71fc6bf037f3f73b4ca63f9ee298e3b42b27fae600
SSDEEP

3072:lxUm75Fku3eKeJk21ZSJReOqlz+mErj+HyHnNVIPL/+ybbiGF+1u46Q7q303lU8O:fU8DkpP1oJ1qlzUWUNVIT/bbbIW09R

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2136	Sample.exe

Loads dropped DLL 2 IoCs

pid	Process
2488	2024-08-08_1806ae04d79a8c39fdca0954699600c8_icedid.exe
2488	2024-08-08_1806ae04d79a8c39fdca0954699600c8_icedid.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\GetDXVer\Sample.exe	2024-08-08_1806ae04d79a8c39fdca0954699600c8_icedid.exe
File opened for modification	C:\Program Files\GetDXVer\Sample.exe	2024-08-08_1806ae04d79a8c39fdca0954699600c8_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-08_1806ae04d79a8c39fdca0954699600c8_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sample.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2488	2024-08-08_1806ae04d79a8c39fdca0954699600c8_icedid.exe
2488	2024-08-08_1806ae04d79a8c39fdca0954699600c8_icedid.exe
2488	2024-08-08_1806ae04d79a8c39fdca0954699600c8_icedid.exe
2488	2024-08-08_1806ae04d79a8c39fdca0954699600c8_icedid.exe
2136	Sample.exe
2136	Sample.exe
2136	Sample.exe
2136	Sample.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2136	2488	2024-08-08_1806ae04d79a8c39fdca0954699600c8_icedid.exe	28
PID 2488 wrote to memory of 2136	2488	2024-08-08_1806ae04d79a8c39fdca0954699600c8_icedid.exe	28
PID 2488 wrote to memory of 2136	2488	2024-08-08_1806ae04d79a8c39fdca0954699600c8_icedid.exe	28
PID 2488 wrote to memory of 2136	2488	2024-08-08_1806ae04d79a8c39fdca0954699600c8_icedid.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-08-08_1806ae04d79a8c39fdca0954699600c8_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-08_1806ae04d79a8c39fdca0954699600c8_icedid.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files\GetDXVer\Sample.exe
  "C:\Program Files\GetDXVer\Sample.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\GetDXVer\Sample.exe

Filesize
282KB

MD5
69d7899c332709043c1b8d23708711a1

SHA1
d4381d9beb6e62b84cc4092d5d3e6c3df4fecbaf

SHA256
754b29c29cc770e00043fbd061e95e5c449b5859b59eed2ab82cfba2ed7e2f15

SHA512
7ed62e17819b774f21f75e6752de10d9ee03080485ce65fb129148f535ed65b7d36a7a636082d139eaf7945bdb4b50657ae2030cf147fe37cf7fbe576293ee98

Download Submit