Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/08/2024, 12:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-12_744149377ee276ab39f9425f778abdea_hacktools_icedid.exe
Resource
win7-20240705-en
General
-
Target
2024-08-12_744149377ee276ab39f9425f778abdea_hacktools_icedid.exe
-
Size
4.2MB
-
MD5
744149377ee276ab39f9425f778abdea
-
SHA1
0a129db5792e18e2b84b610acb9a442a040acb78
-
SHA256
2b8ab002259a7e886e387499ee7f502e9b12ee44c5759941478fea690097599e
-
SHA512
3f60cc90f71c7de6b3eecc92443cbd6bdec177f59616d0eb7b9ca95dca0cd12b54dc033370673fc03787fa135fcc2867a79b2f10210bce7e15fbbb9cafbf1b5f
-
SSDEEP
98304:xzZQvSrGGTNCwsiVXNpoakxGEMoiy0fGK1mU7Qbo0ZVp927Lnz0+UgghGXDiMd0U:LZVXNpoakxGEMoiy0fGK1mU7Qbo0ZVpJ
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2260-47-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-33-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-31-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-27-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-25-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-23-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-15-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-13-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-11-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-9-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-7-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-6-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-5-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-4-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2260-2-0x0000000010000000-0x000000001003E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-12_744149377ee276ab39f9425f778abdea_hacktools_icedid.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2260 2024-08-12_744149377ee276ab39f9425f778abdea_hacktools_icedid.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2260 2024-08-12_744149377ee276ab39f9425f778abdea_hacktools_icedid.exe 2260 2024-08-12_744149377ee276ab39f9425f778abdea_hacktools_icedid.exe 2260 2024-08-12_744149377ee276ab39f9425f778abdea_hacktools_icedid.exe 2260 2024-08-12_744149377ee276ab39f9425f778abdea_hacktools_icedid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-12_744149377ee276ab39f9425f778abdea_hacktools_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-12_744149377ee276ab39f9425f778abdea_hacktools_icedid.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2260