Behavioral task
behavioral1
Sample
387ff39a0b315645f7e36dcecccc566e_icedid_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
387ff39a0b315645f7e36dcecccc566e_icedid_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
387ff39a0b315645f7e36dcecccc566e_icedid_JC.exe
-
Size
7.3MB
-
MD5
387ff39a0b315645f7e36dcecccc566e
-
SHA1
41e05a8aa22a1010e4a078f7c6da7b8b0c42aaa5
-
SHA256
eed472df70e63bcacbe322c082560754c9dbc00545182f160671bc3978f70004
-
SHA512
ebd8528b43123cfdbca327a5a83015bcf7353d5462d72ef32b8a0e16e3f5d4ea5a7fb862673181e08728c1480a67f0e248bb0a4491ba198512d7ce159480d288
-
SSDEEP
98304:EuPb8NbO4g6a3N2RpLM2fcb5e0lD00m3cjwwcLUQd:Xb4y4g9dpOcbTJ0N3Hb
Malware Config
Signatures
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
resource yara_rule sample coreentity -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 387ff39a0b315645f7e36dcecccc566e_icedid_JC.exe
Files
-
387ff39a0b315645f7e36dcecccc566e_icedid_JC.exe.exe windows x86
076700db5f51f17a3a0f5e8db8ba9a9a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
imm32
ImmAssociateContext
kernel32
LCMapStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
VirtualFree
HeapDestroy
HeapCreate
GetDriveTypeA
LCMapStringA
EnumSystemLocalesA
IsValidLocale
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
SetEnvironmentVariableA
GetUserDefaultLCID
IsValidCodePage
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceA
lstrcmpiA
GetTempPathA
GetTempFileNameA
GetACP
ResumeThread
GlobalLock
Sleep
GlobalUnlock
GetLocaleInfoA
RemoveDirectoryA
CreateDirectoryA
FreeLibrary
LoadLibraryA
GetProcAddress
FormatMessageA
LocalFree
InterlockedDecrement
InterlockedIncrement
GetPrivateProfileStringA
CreateProcessA
WaitForSingleObject
CloseHandle
GetPrivateProfileIntA
DeleteFileA
WritePrivateProfileStringA
GetTickCount
lstrlenA
lstrcmpA
lstrcpyA
MultiByteToWideChar
GetModuleHandleA
CreateFileA
GetCommState
SetCommState
SetCommTimeouts
WriteFile
FlushFileBuffers
ReadFile
GetDateFormatA
GetStdHandle
SetHandleCount
HeapSize
GetFileType
SetStdHandle
CreateThread
ExitThread
RtlUnwind
GetStartupInfoA
GetProcessHeap
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualAlloc
ExitProcess
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetProfileIntA
SetErrorMode
GetOEMCP
GetCPInfo
GlobalFlags
VirtualProtect
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
GetDiskFreeSpaceA
GetSystemDirectoryA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetFileTime
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileA
GetModuleFileNameW
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
GetThreadLocale
MoveFileA
SuspendThread
SetThreadPriority
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
FreeResource
GlobalFree
MulDiv
SetLastError
GetVersionExA
GlobalAlloc
CreateNamedPipeA
SetEvent
GetTimeFormatA
CreateEventA
SetFilePointer
GetLocalTime
DisconnectNamedPipe
GetOverlappedResult
WaitForMultipleObjects
ConnectNamedPipe
GetExitCodeThread
CompareStringA
GetVersion
GetStringTypeExA
InterlockedExchange
CompareStringW
GetFileSize
CopyFileA
GetExitCodeProcess
GetCurrentProcessId
SetCurrentDirectoryA
GetCurrentDirectoryA
LeaveCriticalSection
LoadLibraryExA
GetEnvironmentVariableA
DeleteCriticalSection
IsDBCSLeadByte
GetCommandLineA
GetCurrentThreadId
InitializeCriticalSection
EnterCriticalSection
lstrlenW
GetFileAttributesA
RaiseException
GetWindowsDirectoryA
GetPrivateProfileSectionA
GetLastError
GetModuleFileNameA
user32
WindowFromPoint
PostQuitMessage
DestroyCursor
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcA
DefFrameProcA
GetMenuItemInfoA
SetWindowRgn
DrawIcon
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
SetDlgItemInt
GetDlgItemInt
CheckDlgButton
UnpackDDElParam
ReuseDDElParam
GetWindowThreadProcessId
InsertMenuItemA
CreatePopupMenu
SetMenu
TranslateAcceleratorA
GetMessageA
EndPaint
BeginPaint
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetForegroundWindow
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetScrollRange
GetScrollPos
SetWindowContextHelpId
GetClassInfoA
RegisterClassA
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
IsIconic
GetWindowPlacement
GetDesktopWindow
CreateDialogIndirectParamA
IsWindowEnabled
GetNextDlgTabItem
GetMenuState
GetMenuStringA
OffsetRect
FindWindowExA
GetClipboardData
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ValidateRect
CharUpperA
AdjustWindowRectEx
LoadImageA
IsZoomed
UnionRect
IsDlgButtonChecked
GetClassNameA
MessageBeep
GetTopWindow
GetDlgItem
ScreenToClient
IsRectEmpty
EqualRect
IntersectRect
InvalidateRgn
FindWindowA
TabbedTextOutA
SetRectEmpty
SetScrollPos
SetScrollRange
GetFocus
RegisterWindowMessageA
EnumChildWindows
GetWindowTextA
EnumWindows
AppendMenuA
CreateMenu
InsertMenuA
GetMenuItemID
GetMenuItemCount
SetWindowPos
RemoveMenu
CharNextA
DestroyMenu
DestroyAcceleratorTable
ShowOwnedPopups
WaitMessage
CopyAcceleratorTableA
GetNextDlgGroupItem
GetSysColorBrush
UnregisterClassA
GetTabbedTextExtentA
GetDCEx
LockWindowUpdate
DestroyIcon
WindowFromDC
RegisterClipboardFormatA
GetClassInfoExA
LoadAcceleratorsA
SystemParametersInfoA
IsWindow
SetRect
CheckRadioButton
SetCursor
SetCursorPos
GetCursorPos
LoadBitmapA
IsWindowVisible
PostThreadMessageA
SetTimer
MapDialogRect
wsprintfA
GetKeyState
GetActiveWindow
LoadCursorA
DestroyWindow
GetIconInfo
SetMenuItemInfoA
IsMenu
DrawEdge
GetDoubleClickTime
GetMenuDefaultItem
SetMenuDefaultItem
DrawFrameControl
FrameRect
DrawIconEx
DrawCaption
ShowWindow
MoveWindow
BringWindowToTop
SetActiveWindow
LoadStringA
RedrawWindow
InflateRect
ReleaseDC
GetDC
DrawFocusRect
FillRect
CopyRect
ChildWindowFromPointEx
GetSysColor
ChildWindowFromPoint
PtInRect
ReleaseCapture
SetCapture
GetSystemMetrics
CheckMenuItem
GetMenu
GetWindow
LoadIconA
UpdateWindow
SetForegroundWindow
SetWindowLongA
ClientToScreen
DeleteMenu
GetSubMenu
LoadMenuA
SetParent
GetClientRect
InvalidateRect
GetWindowRect
CreateWindowExA
GetParent
GetWindowLongA
EnableMenuItem
GetSystemMenu
DispatchMessageA
TranslateMessage
PeekMessageA
EnableWindow
KillTimer
PostMessageA
MessageBoxA
EndDialog
SendMessageA
ShowScrollBar
gdi32
GetMapMode
Polygon
GetDIBits
Arc
PatBlt
CreateDCA
GetClipBox
SetTextColor
SetBkColor
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetGraphicsMode
SetMapMode
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
SetMapperFlags
SetArcDirection
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
GetPixel
StartDocA
PtVisible
RectVisible
ExtTextOutA
Escape
SetViewportOrgEx
LPtoDP
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
ExtSelectClipRgn
CreatePatternBrush
ExtCreatePen
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
GetBkColor
CreateEllipticRgn
GetViewportOrgEx
SetRectRgn
CombineRgn
GetCharWidthA
StretchDIBits
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextAlign
GetTextFaceA
GetWindowOrgEx
Ellipse
MaskBlt
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
CreateFontA
CreateRectRgnIndirect
GetRgnBox
GetTextColor
DPtoLP
DeleteDC
GetOutlineTextMetricsA
GetDeviceCaps
TextOutA
GetTextExtentPoint32A
BeginPath
FillPath
StrokePath
CreateBrushIndirect
EndPath
CloseFigure
CreateFontIndirectA
GetObjectA
SelectObject
SetPixel
Rectangle
GetStockObject
BitBlt
CreateSolidBrush
CreatePen
OffsetViewportOrgEx
EnumFontFamiliesA
SetPixelV
FillRgn
PtInRegion
CreatePolygonRgn
GetCurrentObject
CreateDIBitmap
GetGraphicsMode
CreateRoundRectRgn
StretchBlt
RectInRegion
GetTextMetricsA
comdlg32
GetFileTitleA
winspool.drv
GetJobA
OpenPrinterA
ClosePrinter
DocumentPropertiesA
advapi32
RegCreateKeyA
GetFileSecurityA
SetFileSecurityA
RegQueryValueA
RegEnumKeyA
RegOpenKeyA
RegSetValueA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegEnumValueA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
shell32
DragFinish
ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
FindExecutableA
DragAcceptFiles
ExtractIconA
SHGetFileInfoA
ShellExecuteExA
SHGetMalloc
DragQueryFileA
shlwapi
PathFindExtensionA
PathStripToRootA
PathIsUNCA
PathIsDirectoryA
PathFindFileNameA
oledlg
ord8
ole32
OleLockRunning
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
StringFromGUID2
CoTaskMemAlloc
CoRegisterClassObject
CoRevokeClassObject
CoInitializeEx
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoInitialize
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
OleTranslateAccelerator
IsAccelerator
oleaut32
SysFreeString
SafeArrayDestroy
SystemTimeToVariantTime
VariantTimeToSystemTime
OleCreateFontIndirect
VariantCopy
RegisterTypeLi
VarUI4FromStr
LoadTypeLi
SysStringLen
SysAllocStringLen
SysAllocStringByteLen
SysAllocString
VariantChangeType
VariantClear
VariantInit
GetErrorInfo
UnRegisterTypeLi
oleacc
LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject
comctl32
ord17
Sections
.text Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 648KB - Virtual size: 645KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ