Analysis
-
max time kernel
138s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
20-11-2024 13:46
General
-
Target
2024-11-20_95294958d03b45f0135df2fb5a69c529_icedid.exe
-
Size
7.2MB
-
MD5
95294958d03b45f0135df2fb5a69c529
-
SHA1
5f34f6a1c75b9520c59133d98ce0fd3e9aee551a
-
SHA256
303633ae3882cc6bd0b78637b95d548c1d2272c73f8cd1a8b8341d82a11b7738
-
SHA512
45801925bb90347a1d93d1c49a41b5cae0850bab096ccd48addad945917a6b27faae6117701ed52366c8f3f7b49d7cbf1796170a628db94c649dd5c79e758657
-
SSDEEP
196608:AnNRTeF+yb6MScdupooKKpqsSCGg57VdB4JJbGsj:weF9+Tp33wn87+bHj
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
-
Loads dropped DLL 6 IoCs
-
VMProtect packed file 9 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in System32 directory 3 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Program Files directory 24 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_95294958d03b45f0135df2fb5a69c529_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_95294958d03b45f0135df2fb5a69c529_icedid.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Inetcorbui\yyzy.exe"C:\Program Files\Inetcorbui\yyzy.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Program Files\Inetcorbui\yyzy.exe"C:\Program Files\Inetcorbui\yyzy.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Program Files\Inetcorbui\yyzy.exe"C:\Program Files\Inetcorbui\yyzy.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Program Files\Inetcorbui\yyzy.exe"C:\Program Files\Inetcorbui\yyzy.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Program Files\Inetcorbui\yyzy.exe"C:\Program Files\Inetcorbui\yyzy.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
603KB
MD5f377db89f18e6c681a7fc42d2dee21fe
SHA12e12cb7aa4bbbecc288809f8388f561811e63b59
SHA25616cce918ca2bb8778599bc56a46ab7a53210d6cd577bc82cbf998323c676d67a
SHA512a181a384c8bf45adb56520464e2062f68a5fb92076f5d7cf6a979b67d1878ee594e7506593c1e74ac05d9db6b13c9d098241b203a332120adabc6605a0cfa60e
-
Filesize
657KB
MD5f287f95e467d239d76fd0cc37efba5d8
SHA1f55e4063edb5659edbeda38c65f5522e1496bc63
SHA2569c9dfa1805bfd738bd6e42023651ab1576b876c10774892210bca1efbfdd4023
SHA5128f6ba290d97e2336a2b88f665a1b980b8a56a15dd3b73af73be8c734ab781f6ce671a2f05db2e1138a15d5a583a867b8c08444da0b8c77bae85b4d84a7ea1edb
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
668KB
-
Filesize
8KB
-
Filesize
636KB
-
Filesize
668KB
-
Filesize
668KB