6d5b80c24138bdfc1b15cb7164b00c758c6042b1a7e5c76e11b7368dea56e309

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-28_9b27f2705cc3efc7637fe6ded1aeff29_icedid.exe
Size

1.6MB
MD5

9b27f2705cc3efc7637fe6ded1aeff29
SHA1

1099762f2781fa82d3c6c35ec032e4521d1cab0a
SHA256

6d5b80c24138bdfc1b15cb7164b00c758c6042b1a7e5c76e11b7368dea56e309
SHA512

ceccd29627aba781c42ea4096bd3d2b2a53d6816a0078a996e6874fdb3ea1e468700156b61bd1961e0bb42936d7d49efdc580a473436381eec7cb651ce407312
SSDEEP

24576:dXaRicFDnikUa0BVdybnnavdZYVESwGMx0/J2GnSatzqcYHQlk7KFknIq3dc:B6ikU0bnaTYVESGIJ2ktzqcYHzQ

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe
3028	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	2784	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-28_9b27f2705cc3efc7637fe6ded1aeff29_icedid.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2784	2024-09-28_9b27f2705cc3efc7637fe6ded1aeff29_icedid.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2784	2024-09-28_9b27f2705cc3efc7637fe6ded1aeff29_icedid.exe
2784	2024-09-28_9b27f2705cc3efc7637fe6ded1aeff29_icedid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 3028	2784	2024-09-28_9b27f2705cc3efc7637fe6ded1aeff29_icedid.exe	31
PID 2784 wrote to memory of 3028	2784	2024-09-28_9b27f2705cc3efc7637fe6ded1aeff29_icedid.exe	31
PID 2784 wrote to memory of 3028	2784	2024-09-28_9b27f2705cc3efc7637fe6ded1aeff29_icedid.exe	31
PID 2784 wrote to memory of 3028	2784	2024-09-28_9b27f2705cc3efc7637fe6ded1aeff29_icedid.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-09-28_9b27f2705cc3efc7637fe6ded1aeff29_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-28_9b27f2705cc3efc7637fe6ded1aeff29_icedid.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 1496
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\2024-09-28_9b27f2705cc3efc7637fe6ded1aeff29_icedid.exe

Filesize
1.6MB

MD5
50b5aec3640eea278d36fb26692ff04a

SHA1
1a5fe25167faa8090005e1f4e5aeb8e47e5d9d33

SHA256
8bf7e59db575aacde6916775ec47026dfc20f46e728471f95c6926debe36995b

SHA512
292af55b23354c68dc358b24dbf2af5fb27bd1e1652915195cf43d37af3128a15f6366db13f7c4ebe74d0a92f20ae564979db55b995b5701a17827f391ff1176

Download Submit
memory/2784-0-0x0000000000400000-0x00000000005CA000-memory.dmp

Filesize
1.8MB

Download
memory/2784-3-0x00000000000E0000-0x00000000000E2000-memory.dmp

Filesize
8KB

Download
memory/2784-4-0x000000000048F000-0x0000000000490000-memory.dmp

Filesize
4KB

Download
memory/2784-7-0x0000000000400000-0x00000000005CA000-memory.dmp

Filesize
1.8MB

Download