abe4763b39eca2755d378f4a1ea59f9f67f6fbe721dcca79b1a8bdd6fce82447

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-18_42486d91f495a6b12471db7e646aced7_icedid.exe
Size

587KB
MD5

42486d91f495a6b12471db7e646aced7
SHA1

97f4e9da0700e99b366e8687a8d69f0423beff12
SHA256

abe4763b39eca2755d378f4a1ea59f9f67f6fbe721dcca79b1a8bdd6fce82447
SHA512

cb841e17f08630ca9b3914741bf2a71b12d6d353a210012f38b45857be18460e13e94d4814a72a206b2e9219047241b3c5039a5339a261439165b4eccd738c03
SSDEEP

12288:LplrVbDdQaqdS/RfraFE/H8uB2Wm0SXsNr5FU:9xR1+FCcuvm0as

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1732	indicator.exe

Loads dropped DLL 2 IoCs

pid	Process
2384	2024-08-18_42486d91f495a6b12471db7e646aced7_icedid.exe
2384	2024-08-18_42486d91f495a6b12471db7e646aced7_icedid.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Update\indicator.exe	2024-08-18_42486d91f495a6b12471db7e646aced7_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-18_42486d91f495a6b12471db7e646aced7_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	indicator.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2384	2024-08-18_42486d91f495a6b12471db7e646aced7_icedid.exe
2384	2024-08-18_42486d91f495a6b12471db7e646aced7_icedid.exe
2384	2024-08-18_42486d91f495a6b12471db7e646aced7_icedid.exe
2384	2024-08-18_42486d91f495a6b12471db7e646aced7_icedid.exe
1732	indicator.exe
1732	indicator.exe
1732	indicator.exe
1732	indicator.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 1732	2384	2024-08-18_42486d91f495a6b12471db7e646aced7_icedid.exe	30
PID 2384 wrote to memory of 1732	2384	2024-08-18_42486d91f495a6b12471db7e646aced7_icedid.exe	30
PID 2384 wrote to memory of 1732	2384	2024-08-18_42486d91f495a6b12471db7e646aced7_icedid.exe	30
PID 2384 wrote to memory of 1732	2384	2024-08-18_42486d91f495a6b12471db7e646aced7_icedid.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-08-18_42486d91f495a6b12471db7e646aced7_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-18_42486d91f495a6b12471db7e646aced7_icedid.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files\Update\indicator.exe
  "C:\Program Files\Update\indicator.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\Update\indicator.exe

Filesize
588KB

MD5
b847882f82113f71239426ee8131d0a8

SHA1
346c13132752e5f615ae925cdba78664d4968728

SHA256
084134f8959d8ce5aa208516428913daac1081da813fe17d23ee35bdef44c7a2

SHA512
d63dd4741e7e6f4b5e46d9e87edbe72374c7d2f51f5df7935bb599f99cd6a4801c68b42d09d87a69dfc88d3d01986bde05d029dd2dc062faef994d6e79d81b1f

Download Submit
memory/1732-10-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/1732-12-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/2384-0-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/2384-8-0x0000000002B80000-0x0000000002D1F000-memory.dmp

Filesize
1.6MB

Download
memory/2384-11-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download