Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 09:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe
Resource
win7-20231129-en
General
-
Target
2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe
-
Size
284KB
-
MD5
43375d4430f8aa4e3808c2874c18ceb8
-
SHA1
73f25b3fed49577de9afa111421705188a48dc31
-
SHA256
d9a821f39c7a139971a5db14603c7683b7227b597ccf58e32aecd022d04b421d
-
SHA512
b102eea1824af104dacbb56d25de7474fce9aeaecfc0094660f197913babb6422270f9f465f62074bf1e601defdb6f84e76d8f317403a4b91174dfb3b4449b81
-
SSDEEP
6144:plDx7mlcAZBcIdqkorDfoR/0C1fzDB9ePHSJ:plDx7mlHZo7HoRv177ePH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
sethome3859.exepid process 3148 sethome3859.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Windows directory 2 IoCs
Processes:
2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exedescription ioc process File created \??\c:\windows\system\sethome3859.exe 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe File opened for modification \??\c:\windows\system\sethome3859.exe 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer start page 1 TTPs 1 IoCs
Processes:
2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.baiduo.org/" 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exepid process 1980 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe 1980 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exesethome3859.exepid process 1980 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe 1980 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe 1980 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe 1980 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe 3148 sethome3859.exe 3148 sethome3859.exe 3148 sethome3859.exe 3148 sethome3859.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exedescription pid process target process PID 1980 wrote to memory of 3148 1980 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe sethome3859.exe PID 1980 wrote to memory of 3148 1980 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe sethome3859.exe PID 1980 wrote to memory of 3148 1980 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe sethome3859.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\sethome3859.exec:\windows\system\sethome3859.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnkFilesize
1KB
MD592d886df5a5a6608446bcb2b4f175d9a
SHA1d32238cd53d16a35891d65ad3fce304fab8fa14a
SHA25636129f8b3734108a83b2e8533373fa7c203f06eca79b26ee6817131ae8516752
SHA5125be9cb89dda6d13b53c9c23021206dfe58d5c0e675eb0551361eac0d9709559195bede05be8e52fafca9c8d8ce356b39f6e17ea5f6acf61954dec0c6fc2f4e11
-
C:\Users\abc.lnkFilesize
1KB
MD5ffc04557536eee3d7597addb48d704de
SHA176bdb409d219c36a239e762778f75fd8ff3ac2fe
SHA2561d3d6e5c351002a4392f87eaf6a7d6c7633e56f73426ae3c56b5c695c705c1b6
SHA512f2693d530f5e7c4fbe3d4019af11083ba900465ce5f5b20fda378a4ce33032b75d12e2281c0dfc194716ebb2c996ce9f0c8b3eb36419ee947f22cc44928723ea
-
C:\Windows\System\sethome3859.exeFilesize
284KB
MD56df93d5b473315353c1a3d9144711b05
SHA1d5e0aedab976e887abbb8360e307026f1de1f5d7
SHA25628e90bb117d5f8ee8157327cd6e33168edafa05c4fa8bb10134e093a3b96e3c4
SHA51238401f61694d4f5b453c717175bae4a82bede5463d691da72c03a6372b541797d4b17b38801c3230926f1d35d174f65b96ee792bef1e26b0e693f7994f15ebea