Analysis
-
max time kernel
140s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
22/04/2025, 04:42
General
-
Target
2025-04-22_cef1a42a6084ac6969ad418256e76961_amadey_elex_icedid_rhadamanthys_smoke-loader.exe
-
Size
2.2MB
-
MD5
cef1a42a6084ac6969ad418256e76961
-
SHA1
ad36c6f687478405ebf3c346ddea399590cfa92b
-
SHA256
c10a7fbb6275bfe9ce6b6bc50621c90eb035925ded44aabfd128305bcad681eb
-
SHA512
745a6aa88b931e1d8ecba9b3b79d7bf9153be0ed855ba5dbbd8fdbbdf390e46c8a382de46b2e00fe55de2c91ba66ce532615a361f7047a2461c810a9e5fb1bd0
-
SSDEEP
24576:F4YKL33onzQqK2vL+Jj/sRJF9PV6GrGkg0Rr5VkMrsTYhsCMAYQWfx5VNRem9KeG:F6HozTKvJsnFVMkgGdu4ndBWNzEeBpu
Malware Config
Signatures
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
NTFS ADS 3 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-04-22_cef1a42a6084ac6969ad418256e76961_amadey_elex_icedid_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-22_cef1a42a6084ac6969ad418256e76961_amadey_elex_icedid_rhadamanthys_smoke-loader.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files\IPADTV6.EXE"C:\Program Files\IPADTV6.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 C:\WINDOWS\Media\ActiveX.ocx /s2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
304KB
MD5b98bcc1c46673b77e7a4d214a7c2be51
SHA131382ca4ddd3f0eb9ffb542e834cebad1ae73e11
SHA2569399dc52df64ea9d51585bd24f386c202a6b7fcfeececa5a6bc8e43e6ba93841
SHA512a17fb97a411703a564dcbcec72d557b27ee31dc77f07098c976a3e36bb6138ea494785f1dd9c1daf1b1f7196c46e44d7c241b0068a7760472e082b974ebe6638
-
Filesize
12B
MD534d01d99c018f097908b243d38f86f92
SHA134c5ae25e324c418e0fd983f39ab0cc7b0d257dc
SHA256b79d4e7fe70d93d75101be2e89a436fa3030bd85544565c6c604ccb1d4e153f7
SHA5120f494673c4f92927f8c16fdb14d29703d5a94bb10061799f34b4283fb3cf78c83c55e815c3ab0e8da47f86692c719946ca4001f8a33de96d7ad759a349e3e645
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
4KB