e483d25a1d3db8688ed5a6c1c7a4c8259da1814dafc7c2a0e9df5cb18db46824

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 08:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-30_7f2848fcb8a551429c34cdf932bed1e7_icedid.exe
Size

516KB
MD5

7f2848fcb8a551429c34cdf932bed1e7
SHA1

a5cf943257807137bf9cbb2a8329552367b03bdd
SHA256

e483d25a1d3db8688ed5a6c1c7a4c8259da1814dafc7c2a0e9df5cb18db46824
SHA512

37055e57a504b3c5dbd93333f6d0e75fca4982b26f4144013fe083d185cead6e9fe44b589660c83bc96d9485255009547d3fa57c1ef256dabc009040b1af38c5
SSDEEP

12288:GjFRIX8qDmc1N/8QsNDhqiB177Fn8s8tzAp6HY7Ra/++Naw/HCdaw9VV:SFCNmcrXsNVR7Fn/8tzu3FM++swdw9f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-30_7f2848fcb8a551429c34cdf932bed1e7_icedid.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1636	2024-12-30_7f2848fcb8a551429c34cdf932bed1e7_icedid.exe

C:\Users\Admin\AppData\Local\Temp\2024-12-30_7f2848fcb8a551429c34cdf932bed1e7_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-30_7f2848fcb8a551429c34cdf932bed1e7_icedid.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-0-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1636-1-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download