fdbfb2f0252e0d0036c3fadb6516d9579e3af2219e1014808a3b6d563034aad8

Analysis

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-08-18_c1f4dd2ebfa3ececcbd5f9b455df378f_icedid.exe
Size

295KB
MD5

c1f4dd2ebfa3ececcbd5f9b455df378f
SHA1

fc2e73a3f969b8416b0104a5ea10b9b8a4c66588
SHA256

fdbfb2f0252e0d0036c3fadb6516d9579e3af2219e1014808a3b6d563034aad8
SHA512

16fee45e65c401dfc59100c9dfffaa4f76f2277439fddaff9d70f3f6027d4dcac561e0faabe22a3aa99cf15a718b656fc53f1473bdf1397bb1da211e0801dc34
SSDEEP

3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1152	December.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Platform\December.exe	2024-08-18_c1f4dd2ebfa3ececcbd5f9b455df378f_icedid.exe
File opened for modification	C:\Program Files\Platform\December.exe	2024-08-18_c1f4dd2ebfa3ececcbd5f9b455df378f_icedid.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1800	2472	WerFault.exe	83
2268	2472	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-18_c1f4dd2ebfa3ececcbd5f9b455df378f_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	December.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2472	2024-08-18_c1f4dd2ebfa3ececcbd5f9b455df378f_icedid.exe
2472	2024-08-18_c1f4dd2ebfa3ececcbd5f9b455df378f_icedid.exe
2472	2024-08-18_c1f4dd2ebfa3ececcbd5f9b455df378f_icedid.exe
2472	2024-08-18_c1f4dd2ebfa3ececcbd5f9b455df378f_icedid.exe
1152	December.exe
1152	December.exe
1152	December.exe
1152	December.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 1152	2472	2024-08-18_c1f4dd2ebfa3ececcbd5f9b455df378f_icedid.exe	85
PID 2472 wrote to memory of 1152	2472	2024-08-18_c1f4dd2ebfa3ececcbd5f9b455df378f_icedid.exe	85
PID 2472 wrote to memory of 1152	2472	2024-08-18_c1f4dd2ebfa3ececcbd5f9b455df378f_icedid.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-08-18_c1f4dd2ebfa3ececcbd5f9b455df378f_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-18_c1f4dd2ebfa3ececcbd5f9b455df378f_icedid.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files\Platform\December.exe
  "C:\Program Files\Platform\December.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 1016
  2⤵
  - Program crash
  PID:1800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 964
  2⤵
  - Program crash
  PID:2268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2472 -ip 2472
1⤵
PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2472 -ip 2472
1⤵
PID:3660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Platform\December.exe

Filesize
295KB

MD5
90af8f4e1202280dd8ede0008f4237b8

SHA1
342ea7114abc25f6d47c57ba505418386d2d627a

SHA256
32a84a951a27199f3aa56071fc7e6ba2a1448c0de56712e3b2bec192170e2108

SHA512
9f9aaec516c85b2afa48aa771bd80af5a2862e7b3828f4c2b0f6ddaa47e23522290d7dcb249497f821fb3d17b32ab14f0cb0d8ba46787f5260955631e119f9f8

Download Submit