Overview

overview

7

Static

static

3

2024-09-14...id.exe

windows7-x64

7

2024-09-14...id.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/09/2024, 01:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-09-14_3b231a3a5a4d598ea28988c5b7680ca8_icedid.exe

  • Size

    10.4MB

  • MD5

    3b231a3a5a4d598ea28988c5b7680ca8

  • SHA1

    58b32977432cd905bc8e9ec69357086ec5e80393

  • SHA256

    6670cbac324064721788614f940f4af779b4b690c6eac9083f0b2140a737a12a

  • SHA512

    aeafca9372498c7a528aeeced82b377a0c3134a352c3c501d3c8c33a32946d9689e86e4acabb147f150e022a9cb7507d25c05cc74368fc68e9792ea945067238

  • SSDEEP

    196608:mo9sdr8m8dYqsBmiFm4CTqfG+vTiwnDmNQkJM8uDIYnKOc7rpY:L948dD4F3e+biSDcQwM8uDuI

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-14_3b231a3a5a4d598ea28988c5b7680ca8_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-14_3b231a3a5a4d598ea28988c5b7680ca8_icedid.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2296
    • C:\Users\Admin\AppData\Roaming\datatemp\aria2c.exe
      "C:\Users\Admin\AppData\Roaming\datatemp\aria2c.exe" --conf-path=C:\Users\Admin\AppData\Roaming\datatemp\aria2.conf #--save-session=C:\Users\Admin\AppData\Roaming\datatemp\aria2.session --input-file=C:\Users\Admin\AppData\Roaming\datatemp\aria2.session --rpc-listen-port=7022 --listen-port=7055 --dht-listen-port=7033 --enable-rpc=true --rpc-allow-origin-all=true --disable-ipv6=false --rpc-secret=123 --enable-dht=true --enable-dht6=true --dht-file-path=C:/Users/Admin/AppData/Roaming/datatemp/dht.dat --dht-file-path6=C:/Users/Admin/AppData/Roaming/datatemp/dht6.dat --bt-external-ip= --stop-with-process=2296
      2⤵
      • Executes dropped EXE
      PID:1992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\datatemp\aria2.conf
    Filesize

    55KB

    MD5

    4a1b71ede6ff12456038f6a26e356a42

    SHA1

    16af6552ebbeb0300d1451715add745e840ff993

    SHA256

    0ee9c9e686a595f86d25854bca6e92e8bfd51437a28306b4eaebf736156cc7ee

    SHA512

    bea15214c76083c86f4104e569bb93ba7000e4e555382b6cc97e0c9bdb6b4de72f50b8458d4c3420e073edefe4f40b7eea580000001d089fd5c78e303fbd8501

    Download Submit

  • \Users\Admin\AppData\Roaming\datatemp\aria2c.exe
    Filesize

    4.8MB

    MD5

    a5c047f169471bd325552c255d6c04af

    SHA1

    e313cff2f3d668ec5d0e90920bd622b0f38aed9d

    SHA256

    cec8bb942475690363c1558fdf55e3cf59f29607967a822a626d4976a348334a

    SHA512

    6cf929d36ea0c95815d3218a3b11f0c8f539a6113c368642a70d41379145ba7ace9aed1e5b78836a4cd2ca861d9bcd10fea3e7fc126adb85822ed4cf4f762f0d

    Download Submit

  • \Users\Admin\AppData\Roaming\datatemp\libcurl.dll
    Filesize

    2.5MB

    MD5

    298f5812023bab65ee23d13ee9489a6e

    SHA1

    71e9d7f205e5e7af6907c539c77a3aeea971692f

    SHA256

    fe100d35b034c15ae3b74379f4eedd321c8e4b84fe666b54ee924ca2a8bdca6e

    SHA512

    217258fb7728f61199f913fb98c894077c12a124e1596d1c6c7cfc065d4d2a6e1e03ad950c3321e2a8dcd997fb5c9524f98530db4bcb39f9914ecb5ff0e22dbd

    Download Submit

  • memory/1992-25-0x0000000000400000-0x00000000008CE000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1992-26-0x0000000000400000-0x00000000008CE000-memory.dmp

    Filesize

    4.8MB

    Download