b1e165a77e4b0de2cd16fdd3994e9cddf0d1f13f1e80bd277385c7d2a8943203

General

Target

2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe
Size

1.4MB
MD5

c67458b66654620c987e8972a061b44a
SHA1

ba30abd10090c36a042a3d69b4cea193b61a07a6
SHA256

b1e165a77e4b0de2cd16fdd3994e9cddf0d1f13f1e80bd277385c7d2a8943203
SHA512

8844414bfedf5f80535174db0d4806c2dd72f1b8cde4b6b3b41a1218cf35689ec489108512e65093111e4312445ec1a6082a5c73b4d04def9bbe66561f911034
SSDEEP

24576:0du5vgFkYZvT6D9fdqFgb2neiQTXYQq+ArdxX1ZYV52ErKB:uu5vgFkYKfdqFM2neiQTxq+Ar7X/SkEr

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\sqeA.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\sqeA.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\sqeA.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\sqeA.exe	aspack_v212_v242

Executes dropped EXE 2 IoCs

Processes:

sqeA.exe_updateRun.exe

pid process

1328 sqeA.exe
836 _updateRun.exe

pid	process
1328	sqeA.exe
836	_updateRun.exe

Loads dropped DLL 3 IoCs

Processes:

2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe

pid	process
624	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe
624	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe
624	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe

Drops file in Program Files directory 64 IoCs

Processes:

sqeA.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	sqeA.exe
File opened for modification	C:\Program Files\Windows Mail\WinMail.exe	sqeA.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE	sqeA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE	sqeA.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	sqeA.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	sqeA.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	sqeA.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ktab.exe	sqeA.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	sqeA.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE	sqeA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	sqeA.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe	sqeA.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE	sqeA.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	sqeA.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE	sqeA.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jp2launcher.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jre7\bin\unpack200.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateOnDemand.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE	sqeA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE	sqeA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	sqeA.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe	sqeA.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE	sqeA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE	sqeA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE	sqeA.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	sqeA.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateCore.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javacpl.exe	sqeA.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\Hearts.exe	sqeA.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe	sqeA.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler.exe	sqeA.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe	sqeA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

_updateRun.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	_updateRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	_updateRun.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	_updateRun.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe_updateRun.exe

pid process

624 2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe
836 _updateRun.exe
836 _updateRun.exe
836 _updateRun.exe
836 _updateRun.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exesqeA.exe

description	pid	process	target process
PID 624 wrote to memory of 1328	624	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe	sqeA.exe
PID 624 wrote to memory of 1328	624	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe	sqeA.exe
PID 624 wrote to memory of 1328	624	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe	sqeA.exe
PID 624 wrote to memory of 1328	624	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe	sqeA.exe
PID 624 wrote to memory of 836	624	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe	_updateRun.exe
PID 624 wrote to memory of 836	624	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe	_updateRun.exe
PID 624 wrote to memory of 836	624	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe	_updateRun.exe
PID 624 wrote to memory of 836	624	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe	_updateRun.exe
PID 624 wrote to memory of 836	624	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe	_updateRun.exe
PID 624 wrote to memory of 836	624	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe	_updateRun.exe
PID 624 wrote to memory of 836	624	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe	_updateRun.exe
PID 1328 wrote to memory of 1796	1328	sqeA.exe	cmd.exe
PID 1328 wrote to memory of 1796	1328	sqeA.exe	cmd.exe
PID 1328 wrote to memory of 1796	1328	sqeA.exe	cmd.exe
PID 1328 wrote to memory of 1796	1328	sqeA.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe
"C:\Users\Admin\AppData\Local\Temp\2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624

C:\Users\Admin\AppData\Local\Temp\sqeA.exe
C:\Users\Admin\AppData\Local\Temp\sqeA.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\28274b36.bat" "
3⤵
PID:1796

C:\Users\Admin\AppData\Local\Temp\_updateRun.exe
_updateRun.exe
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\28274b36.bat
Filesize
183B

MD5
5097ef27723f47d61758af9c80e06e5c

SHA1
7712f1bc616285a36e685be7d3eba5641299f142

SHA256
9945b3b07b6a795193d4b75453acd4e19c64f03131edbaaa529d9f0c5bf4c329

SHA512
2bb021e0a27fe305c2ba54cb48ceb7e44344159dcc15396a4c7758ec1891e96e19c7c25c325bb220b9982cff9abc6dea0463ea39de13ef4aca460530561cd104

Download Submit
C:\Users\Admin\AppData\Local\Temp\_updateRun.exe
Filesize
1.4MB

MD5
c67458b66654620c987e8972a061b44a

SHA1
ba30abd10090c36a042a3d69b4cea193b61a07a6

SHA256
b1e165a77e4b0de2cd16fdd3994e9cddf0d1f13f1e80bd277385c7d2a8943203

SHA512
8844414bfedf5f80535174db0d4806c2dd72f1b8cde4b6b3b41a1218cf35689ec489108512e65093111e4312445ec1a6082a5c73b4d04def9bbe66561f911034

Download Submit
C:\Users\Admin\AppData\Local\Temp\_updateRun.exe
Filesize
1.4MB

MD5
c67458b66654620c987e8972a061b44a

SHA1
ba30abd10090c36a042a3d69b4cea193b61a07a6

SHA256
b1e165a77e4b0de2cd16fdd3994e9cddf0d1f13f1e80bd277385c7d2a8943203

SHA512
8844414bfedf5f80535174db0d4806c2dd72f1b8cde4b6b3b41a1218cf35689ec489108512e65093111e4312445ec1a6082a5c73b4d04def9bbe66561f911034

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqeA.exe
Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqeA.exe
Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
\Users\Admin\AppData\Local\Temp\_updateRun.exe
Filesize
1.4MB

MD5
c67458b66654620c987e8972a061b44a

SHA1
ba30abd10090c36a042a3d69b4cea193b61a07a6

SHA256
b1e165a77e4b0de2cd16fdd3994e9cddf0d1f13f1e80bd277385c7d2a8943203

SHA512
8844414bfedf5f80535174db0d4806c2dd72f1b8cde4b6b3b41a1218cf35689ec489108512e65093111e4312445ec1a6082a5c73b4d04def9bbe66561f911034

Download Submit
\Users\Admin\AppData\Local\Temp\sqeA.exe
Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
\Users\Admin\AppData\Local\Temp\sqeA.exe
Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
memory/624-66-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/624-65-0x0000000000400000-0x00000000005CF000-memory.dmp

Filesize
1.8MB

Download
memory/624-54-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download
memory/624-67-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/624-69-0x00000000021A0000-0x000000000236F000-memory.dmp

Filesize
1.8MB

Download
memory/624-71-0x0000000000400000-0x00000000005CF000-memory.dmp

Filesize
1.8MB

Download
memory/836-70-0x0000000000400000-0x00000000005CF000-memory.dmp

Filesize
1.8MB

Download
memory/836-62-0x0000000000000000-mapping.dmp

Download
memory/836-77-0x0000000000400000-0x00000000005CF000-memory.dmp

Filesize
1.8MB

Download
memory/1328-68-0x0000000000FA0000-0x0000000000FA9000-memory.dmp

Filesize
36KB

Download
memory/1328-73-0x0000000000FA0000-0x0000000000FA9000-memory.dmp

Filesize
36KB

Download
memory/1328-57-0x0000000000000000-mapping.dmp

Download
memory/1796-72-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads