c0253784514db99bb0d4c43805417ec4822753f5b79f48f921ff2d669ed1dfc8

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 12:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-13_7635b593fc68bf4f8fd2eff5c9d030e2_icedid.exe
Size

362KB
MD5

7635b593fc68bf4f8fd2eff5c9d030e2
SHA1

ee248f9d81a505cf091fa0ae5e712b89d2f5fd70
SHA256

c0253784514db99bb0d4c43805417ec4822753f5b79f48f921ff2d669ed1dfc8
SHA512

e053acf9a2e33b38d84da4b350788bd43b1c34805b7bb940f169a332610988fba92ec095afd50f3dd4c0609742c3d08dc3fb4c004671ac0d2fa10fcd93df8902
SSDEEP

6144:SplrlbbDdQaqd2X/96fr3KFEUGjr8uB2WgcA0cpXEVNrvGZ4FUqm6:SplrVbDdQaqdS/ofraFErH8uB2Wm0SXj

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4876	Reference.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\facilitates\Reference.exe	2024-10-13_7635b593fc68bf4f8fd2eff5c9d030e2_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-13_7635b593fc68bf4f8fd2eff5c9d030e2_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reference.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3336	2024-10-13_7635b593fc68bf4f8fd2eff5c9d030e2_icedid.exe
3336	2024-10-13_7635b593fc68bf4f8fd2eff5c9d030e2_icedid.exe
3336	2024-10-13_7635b593fc68bf4f8fd2eff5c9d030e2_icedid.exe
3336	2024-10-13_7635b593fc68bf4f8fd2eff5c9d030e2_icedid.exe
4876	Reference.exe
4876	Reference.exe
4876	Reference.exe
4876	Reference.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 4876	3336	2024-10-13_7635b593fc68bf4f8fd2eff5c9d030e2_icedid.exe	83
PID 3336 wrote to memory of 4876	3336	2024-10-13_7635b593fc68bf4f8fd2eff5c9d030e2_icedid.exe	83
PID 3336 wrote to memory of 4876	3336	2024-10-13_7635b593fc68bf4f8fd2eff5c9d030e2_icedid.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-10-13_7635b593fc68bf4f8fd2eff5c9d030e2_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-13_7635b593fc68bf4f8fd2eff5c9d030e2_icedid.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Program Files\facilitates\Reference.exe
  "C:\Program Files\facilitates\Reference.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\facilitates\Reference.exe

Filesize
363KB

MD5
3aa2325777da3678f4e3f48fe4530a06

SHA1
944655f576e902fbf6f9a73be8b7ea9f7341cd3f

SHA256
17d5a549f6b631474c1f36a75897479d03ef3cba07b8549c54d91aa9c0e03d19

SHA512
db8076245f23f4a899c118195243635f885a7c8452d0859818b213ef0644356c595aee915b45bbc47cc54f83b92c833615c583514730e34f1c9477bc2f73d942

Download Submit