Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12/09/2024, 04:08
General
-
Target
2024-09-12_cc64f506f16b7c1f552d4ad7b96f7cd7_icedid.exe
-
Size
4.9MB
-
MD5
cc64f506f16b7c1f552d4ad7b96f7cd7
-
SHA1
b9dc1bbe59e88f166edd03068bb05898e9b012cd
-
SHA256
b98f0d25cc0a05ba7d9a03a44bef587df8f67daad7db78413e2159a2d9ee57ba
-
SHA512
f7d64598ded70eac105e5a9ae35dd6130ca431c24bd4634b7bf8f292a2d6b6b60a80f396c69f5a96644b43b0db7dcb871f6b5df3caf55990425c3cdf7ec91390
-
SSDEEP
98304:mWNZ3UIbNns6w2ewgZ+APl4QfLG+0RmeiJRboQLUFrv2yuNJ:53bOEelYA+erFJRbxFNJ
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 2 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-12_cc64f506f16b7c1f552d4ad7b96f7cd7_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-12_cc64f506f16b7c1f552d4ad7b96f7cd7_icedid.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD5a3ef2c7957a23d32db2e121f6228234b
SHA1dd0aa7d989a2c6034ce691d53d330116647d4a4d
SHA256cb8acb2a4fce4b8a2c75b787d387f3c1081a187e567edb49e2d88e0d312cfab2
SHA512b696705f05e1ada8a0e87f4915606cc8a6a66ba8bc94d939cae3486cfbd78847e4823b343fe26b1576bbdfdf413096b40973dfe944683ea55167e65bdefa79f4
-
Filesize
3.8MB
MD57a73ccc42d632f5bf61ba3d08c44fac1
SHA140ef8ff11b3916f93630601b0be34c08b707742e
SHA25658bd286a0cbe502d465c2618d8ffb4abdb23f09954d8c18c439b4fc432441d5e
SHA5125247e10de5401aae6f24a70ac6f6d1d9fa8b08a8df4a2cdf2a50772189120f642882943ef1b3081746629d46cd1b52c5e3b75a5907fd1864464b8037b2387aff
-
Filesize
40KB
-
Filesize
8.1MB
-
Filesize
5.9MB
-
Filesize
8.1MB
-
Filesize
9.0MB
-
Filesize
88KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
5.9MB
-
Filesize
4KB
-
Filesize
9.0MB
-
Filesize
88KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB