1f7388485aefd9df91ebd61f7b17b71de5578fb6295619fbc93ac8821234d086

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 18:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-08-09_96bbbaea333f7871077e9452baaf822b_icedid.exe
Size

283KB
MD5

96bbbaea333f7871077e9452baaf822b
SHA1

21d2fd34eff8a871b27f2e6ef0d6eaa8ec771f1a
SHA256

1f7388485aefd9df91ebd61f7b17b71de5578fb6295619fbc93ac8821234d086
SHA512

fd07d08f57ffec69ef8cd30b4396f978e51227e5333d221a178da15ca30a07bb4243d8a68b480f4c8b0d8fbe68ef9ce575c0030ea722109a1b212f8fbebc35ee
SSDEEP

3072:lxUm75Fku3eKeJk21ZSJReOqlz+mErj+HyHnNVIPL/+ybbiGF+1u46Q7q303lU8O:fU8DkpP1oJ1qlzUWUNVIT/bbbIW09R

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2028	DirectSetup.exe

Loads dropped DLL 4 IoCs

pid	Process
2776	2024-08-09_96bbbaea333f7871077e9452baaf822b_icedid.exe
2028	DirectSetup.exe
2028	DirectSetup.exe
2028	DirectSetup.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\with\DirectSetup.exe	2024-08-09_96bbbaea333f7871077e9452baaf822b_icedid.exe
File created	C:\Program Files\with\DirectSetup.exe	2024-08-09_96bbbaea333f7871077e9452baaf822b_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-09_96bbbaea333f7871077e9452baaf822b_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DirectSetup.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2776	2024-08-09_96bbbaea333f7871077e9452baaf822b_icedid.exe
2776	2024-08-09_96bbbaea333f7871077e9452baaf822b_icedid.exe
2776	2024-08-09_96bbbaea333f7871077e9452baaf822b_icedid.exe
2776	2024-08-09_96bbbaea333f7871077e9452baaf822b_icedid.exe
2028	DirectSetup.exe
2028	DirectSetup.exe
2028	DirectSetup.exe
2028	DirectSetup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2028	2776	2024-08-09_96bbbaea333f7871077e9452baaf822b_icedid.exe	30
PID 2776 wrote to memory of 2028	2776	2024-08-09_96bbbaea333f7871077e9452baaf822b_icedid.exe	30
PID 2776 wrote to memory of 2028	2776	2024-08-09_96bbbaea333f7871077e9452baaf822b_icedid.exe	30
PID 2776 wrote to memory of 2028	2776	2024-08-09_96bbbaea333f7871077e9452baaf822b_icedid.exe	30
PID 2776 wrote to memory of 2028	2776	2024-08-09_96bbbaea333f7871077e9452baaf822b_icedid.exe	30
PID 2776 wrote to memory of 2028	2776	2024-08-09_96bbbaea333f7871077e9452baaf822b_icedid.exe	30
PID 2776 wrote to memory of 2028	2776	2024-08-09_96bbbaea333f7871077e9452baaf822b_icedid.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-08-09_96bbbaea333f7871077e9452baaf822b_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-09_96bbbaea333f7871077e9452baaf822b_icedid.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files\with\DirectSetup.exe
  "C:\Program Files\with\DirectSetup.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\with\DirectSetup.exe

Filesize
283KB

MD5
ca37f7eb34b3476e3254de25ed6612c7

SHA1
38be5ba9fb3072d6cc57f6e57c7b524cab008fea

SHA256
73232b3af59f5bddbd034204f4c6bf98661fba478c2df2d6ad22ae4b2f4d90bf

SHA512
b3751baf219a6e39d32b382b92464b3238dc071f56e2a49210ee5d012a89de25ef5b004a2232f3cd768627d11b6e0176f69a38293e30128ae9a17d74114eb9a2

Download Submit