b1e165a77e4b0de2cd16fdd3994e9cddf0d1f13f1e80bd277385c7d2a8943203

General

Target

2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe
Size

1.4MB
MD5

c67458b66654620c987e8972a061b44a
SHA1

ba30abd10090c36a042a3d69b4cea193b61a07a6
SHA256

b1e165a77e4b0de2cd16fdd3994e9cddf0d1f13f1e80bd277385c7d2a8943203
SHA512

8844414bfedf5f80535174db0d4806c2dd72f1b8cde4b6b3b41a1218cf35689ec489108512e65093111e4312445ec1a6082a5c73b4d04def9bbe66561f911034
SSDEEP

24576:0du5vgFkYZvT6D9fdqFgb2neiQTXYQq+ArdxX1ZYV52ErKB:uu5vgFkYKfdqFM2neiQTxq+Ar7X/SkEr

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\sqeA.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\sqeA.exe	aspack_v212_v242

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

sqeA.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation sqeA.exe
Executes dropped EXE 2 IoCs

Processes:

sqeA.exe_updateRun.exe

pid process

3368 sqeA.exe
3112 _updateRun.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	sqeA.exe

pid	process
3368	sqeA.exe
3112	_updateRun.exe

Drops file in Program Files directory 64 IoCs

Processes:

sqeA.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7z.exe	sqeA.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe	sqeA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	sqeA.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateSetup.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe	sqeA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	sqeA.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe	sqeA.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe	sqeA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	sqeA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	sqeA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	sqeA.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	sqeA.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe	sqeA.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe	sqeA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	sqeA.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe	sqeA.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe	sqeA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	sqeA.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe	sqeA.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe	sqeA.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	sqeA.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe	sqeA.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	sqeA.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe	sqeA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	sqeA.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe	sqeA.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe	sqeA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	sqeA.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	sqeA.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	sqeA.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	sqeA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	sqeA.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	sqeA.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	sqeA.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	sqeA.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe	sqeA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	sqeA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	sqeA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	sqeA.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe	sqeA.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe	sqeA.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	sqeA.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe	sqeA.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe	sqeA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe_updateRun.exe

pid process

1048 2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe
3112 _updateRun.exe
3112 _updateRun.exe
3112 _updateRun.exe
3112 _updateRun.exe

pid	process
1048	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe
3112	_updateRun.exe
3112	_updateRun.exe
3112	_updateRun.exe
3112	_updateRun.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exesqeA.exe

description	pid	process	target process
PID 1048 wrote to memory of 3368	1048	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe	sqeA.exe
PID 1048 wrote to memory of 3368	1048	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe	sqeA.exe
PID 1048 wrote to memory of 3368	1048	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe	sqeA.exe
PID 1048 wrote to memory of 3112	1048	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe	_updateRun.exe
PID 1048 wrote to memory of 3112	1048	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe	_updateRun.exe
PID 1048 wrote to memory of 3112	1048	2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe	_updateRun.exe
PID 3368 wrote to memory of 3440	3368	sqeA.exe	cmd.exe
PID 3368 wrote to memory of 3440	3368	sqeA.exe	cmd.exe
PID 3368 wrote to memory of 3440	3368	sqeA.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe
"C:\Users\Admin\AppData\Local\Temp\2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048

C:\Users\Admin\AppData\Local\Temp\sqeA.exe
C:\Users\Admin\AppData\Local\Temp\sqeA.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3368

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7fcd5ff0.bat" "
3⤵
PID:3440

C:\Users\Admin\AppData\Local\Temp\_updateRun.exe
_updateRun.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7fcd5ff0.bat
Filesize
183B

MD5
fbeb690689154ce2c7de88556fa8af27

SHA1
43e5dbb7071093482885a7009fc5187141590022

SHA256
91104480e0e5962a2e866fc9e1e5865ce0dd9bd27ac35544a99e400ce91c101b

SHA512
8f4154402a4ad878971eb1467d2577433d5b0648684088dc90c36eaea9e7a80f7a7b28617028159a561a2ff38132750d5db285cb92fea178ac6f8e01510266c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_updateRun.exe
Filesize
1.4MB

MD5
c67458b66654620c987e8972a061b44a

SHA1
ba30abd10090c36a042a3d69b4cea193b61a07a6

SHA256
b1e165a77e4b0de2cd16fdd3994e9cddf0d1f13f1e80bd277385c7d2a8943203

SHA512
8844414bfedf5f80535174db0d4806c2dd72f1b8cde4b6b3b41a1218cf35689ec489108512e65093111e4312445ec1a6082a5c73b4d04def9bbe66561f911034

Download Submit
C:\Users\Admin\AppData\Local\Temp\_updateRun.exe
Filesize
1.4MB

MD5
c67458b66654620c987e8972a061b44a

SHA1
ba30abd10090c36a042a3d69b4cea193b61a07a6

SHA256
b1e165a77e4b0de2cd16fdd3994e9cddf0d1f13f1e80bd277385c7d2a8943203

SHA512
8844414bfedf5f80535174db0d4806c2dd72f1b8cde4b6b3b41a1218cf35689ec489108512e65093111e4312445ec1a6082a5c73b4d04def9bbe66561f911034

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqeA.exe
Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqeA.exe
Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
memory/1048-135-0x0000000000400000-0x00000000005CF000-memory.dmp

Filesize
1.8MB

Download
memory/1048-141-0x0000000000400000-0x00000000005CF000-memory.dmp

Filesize
1.8MB

Download
memory/3112-137-0x0000000000000000-mapping.dmp

Download
memory/3112-140-0x0000000000400000-0x00000000005CF000-memory.dmp

Filesize
1.8MB

Download
memory/3112-145-0x0000000000400000-0x00000000005CF000-memory.dmp

Filesize
1.8MB

Download
memory/3368-136-0x0000000000B90000-0x0000000000B99000-memory.dmp

Filesize
36KB

Download
memory/3368-143-0x0000000000B90000-0x0000000000B99000-memory.dmp

Filesize
36KB

Download
memory/3368-132-0x0000000000000000-mapping.dmp

Download
memory/3440-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads