Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-05_f8ece9a868857d7924ec82b27db84344_icedid_stoberox_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-05_f8ece9a868857d7924ec82b27db84344_icedid_stoberox_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.2023-09-05_f8ece9a868857d7924ec82b27db84344_icedid_stoberox_JC.exe
-
Size
3.6MB
-
MD5
f8ece9a868857d7924ec82b27db84344
-
SHA1
3bd9cfe3ac0f353c832e509cedce8bdaaa6be3ae
-
SHA256
03b6fc82c6c488b6a2030c97b9565bc5b9c39a88fbd00d3a058ef1e4f293f145
-
SHA512
6c3ed78729d9a14eccec3c420303c7c1fb61fb5b043a0b9dee904e5ac311d71dc8363444ff489f2e913bda1ccc08cd1960c45462b805e62677edc74eff9a11cf
-
SSDEEP
98304:B9w/+d7MYT25998jUzLGYlYYzvEETxKPwlMjro6Ca/z:B9wQAy25P8FEvzO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.2023-09-05_f8ece9a868857d7924ec82b27db84344_icedid_stoberox_JC.exe
Files
-
NEAS.2023-09-05_f8ece9a868857d7924ec82b27db84344_icedid_stoberox_JC.exe.exe windows:5 windows x86
268b8527a449a92b56c623ccf8b1c1dd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
WSASetLastError
ioctlsocket
htons
WSAAsyncSelect
socket
shutdown
send
recv
connect
closesocket
WSACleanup
WSAStartup
WSACancelBlockingCall
gethostname
gethostbyname
inet_addr
winmm
PlaySoundA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
ssleay32
ord130
ord127
ord141
websockets
lws_create_context
lws_context_destroy
lws_client_connect_via_info
lws_service
lws_cancel_service_pt
lws_set_log_level
lws_write
lws_callback_on_writable
lws_wsi_user
lws_send_pipe_choked
lws_get_ssl
lws_close_reason
lws_cancel_service
_lws_log
kernel32
GetOEMCP
GetCPInfo
lstrcpyA
FindResourceExW
GetCurrentDirectoryA
GetWindowsDirectoryA
VerSetConditionMask
VerifyVersionInfoA
GetTempFileNameA
GetProfileIntA
SearchPathA
GetDiskFreeSpaceA
ReplaceFileA
GetUserDefaultLCID
LocalLock
LocalUnlock
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetSystemDefaultUILanguage
GetFileSizeEx
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
SetProcessAffinityMask
VirtualFree
VirtualAlloc
GetVersionExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
OutputDebugStringW
GetUserDefaultUILanguage
GetLocaleInfoW
CompareStringW
GlobalFlags
SetErrorMode
SetFileTime
SetFileAttributesA
LocalFileTimeToFileTime
InitializeSListHead
GetFileAttributesExA
SystemTimeToFileTime
GetAtomNameA
LocalReAlloc
GlobalHandle
GlobalReAlloc
InitializeCriticalSection
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetCurrentProcessId
GetVersionExA
VirtualProtect
ResumeThread
SuspendThread
SetThreadPriority
CreateEventA
SetEvent
lstrcmpA
FileTimeToLocalFileTime
CompareStringA
GlobalGetAtomNameA
GlobalFindAtomA
GlobalAddAtomA
GetFileTime
FindResourceA
lstrcmpW
GlobalDeleteAtom
FreeResource
GetSystemDirectoryW
EncodePointer
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
LocalAlloc
LoadLibraryExW
FreeLibrary
GetStringTypeExA
GetThreadLocale
GetVolumeInformationA
lstrcmpiA
GetShortPathNameA
LoadLibraryW
LoadLibraryExA
GetModuleFileNameW
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetFullPathNameA
FlushFileBuffers
FormatMessageA
LocalFree
GlobalSize
FormatMessageW
GetModuleHandleW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
SetLastError
QueryPerformanceFrequency
QueryPerformanceCounter
TryEnterCriticalSection
GetNativeSystemInfo
GetExitCodeThread
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
WaitForSingleObjectEx
DuplicateHandle
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
ExitThread
CreateThread
Sleep
MultiByteToWideChar
FindNextFileA
FindFirstFileA
FindClose
GetVersion
LoadLibraryA
GlobalFree
GetProcAddress
GetTickCount
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetACP
GetFileAttributesA
OutputDebugStringA
MoveFileA
DeleteFileA
MulDiv
ReadFile
GetFileSize
GlobalUnlock
GlobalLock
GlobalAlloc
CreateFileA
GetTempPathA
GetModuleHandleA
GetModuleFileNameA
CloseHandle
WriteFile
WideCharToMultiByte
CopyFileA
CreateDirectoryA
FindResourceW
SizeofResource
LoadResource
LockResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
DecodePointer
QueryDepthSList
UnregisterWaitEx
WaitForMultipleObjectsEx
RtlUnwind
GetModuleHandleExW
GetSystemInfo
VirtualQuery
GetFullPathNameW
GetCommandLineA
GetCommandLineW
SetStdHandle
GetFileType
HeapQueryInformation
ExitProcess
GetStdHandle
GetStringTypeW
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
GetDriveTypeW
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
RtlCaptureStackBackTrace
FindFirstFileExA
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
DeleteFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
WriteConsoleW
CreateFileW
InterlockedFlushSList
user32
CheckRadioButton
CheckDlgButton
GetDlgItemTextA
SetDlgItemTextA
GetDlgItemInt
SetDlgItemInt
GetMonitorInfoA
MonitorFromWindow
WinHelpA
GetScrollInfo
SetScrollInfo
LoadIconA
GetLastActivePopup
GetClassNameA
GetClassLongA
EqualRect
AdjustWindowRectEx
RemovePropA
GetPropA
SetPropA
GetScrollRange
SetScrollRange
ScrollWindow
RedrawWindow
ValidateRect
EndPaint
BeginPaint
TrackPopupMenuEx
GetMenu
SetWindowPlacement
IsChild
CreateWindowExA
GetClassInfoExA
DefWindowProcA
GetMessageTime
GetMessagePos
PeekMessageA
DispatchMessageA
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetScrollPos
SetScrollPos
CharUpperA
GetClassInfoA
RegisterClassA
GetWindowPlacement
MoveWindow
GetDesktopWindow
SetCaretPos
DestroyCaret
CreateCaret
EnableScrollBar
InsertMenuItemA
CloseWindow
GetKeyboardLayout
ShowCaret
HideCaret
MessageBeep
LockWindowUpdate
IsDlgButtonChecked
GetWindow
DestroyWindow
FindWindowExA
UpdateWindow
ShowWindow
GetIconInfo
CopyImage
PtInRect
IsWindow
wsprintfA
LoadImageA
CreateDialogIndirectParamA
GetTopWindow
FindWindowA
ShowScrollBar
SetMenuItemInfoA
TrackPopupMenu
DeleteMenu
RemoveMenu
ModifyMenuA
InsertMenuA
CheckMenuItem
CreateMenu
DrawMenuBar
GetMenuStringA
SendNotifyMessageA
TranslateAcceleratorA
CreateAcceleratorTableA
BringWindowToTop
IsIconic
FlashWindow
IsWindowEnabled
GetFocus
GetDlgCtrlID
UnregisterHotKey
RegisterHotKey
SystemParametersInfoA
CopyRect
GetMenuItemInfoA
IsMenu
ScreenToClient
GetCursorPos
KillTimer
SetTimer
GetKeyState
CharNextExA
LoadCursorW
LoadCursorA
FillRect
ClientToScreen
SetCursor
ReleaseDC
ReleaseCapture
SetCapture
GetCapture
SetWindowPos
GetSysColorBrush
SubtractRect
TranslateMDISysAccel
DefMDIChildProcA
SendDlgItemMessageA
ScrollWindowEx
GetForegroundWindow
IsDialogMessageA
DefFrameProcA
OffsetRect
InflateRect
GetDC
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
PostMessageA
SetActiveWindow
EnableMenuItem
GetSystemMenu
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowLongA
GetWindowLongA
EndDialog
GetNextDlgTabItem
GetActiveWindow
DrawTextExA
GrayStringA
TabbedTextOutA
GetWindowDC
IntersectRect
WindowFromPoint
GetMessageA
TranslateMessage
GetKeyNameTextA
MapVirtualKeyA
SetRectEmpty
GetAsyncKeyState
MapDialogRect
GetWindowThreadProcessId
GetSysColor
GetWindowTextLengthA
SetWindowTextA
GetSystemMetrics
IsWindowVisible
CallWindowProcA
SetRect
DestroyIcon
GetMenuBarInfo
UnpackDDElParam
ReuseDDElParam
MonitorFromRect
GetTabbedTextExtentW
GetTabbedTextExtentA
DestroyCursor
GetWindowRgn
WindowFromDC
LoadIconW
EnumChildWindows
GetUpdateRect
IsClipboardFormatAvailable
CharUpperBuffA
RegisterClipboardFormatA
GetDoubleClickTime
SetMenuDefaultItem
LoadAcceleratorsW
ToAsciiEx
GetKeyboardState
MapVirtualKeyExA
IsCharLowerA
RegisterWindowMessageA
UnregisterClassA
LoadAcceleratorsA
DestroyAcceleratorTable
CopyAcceleratorTableA
LoadMenuA
GetMenuState
DestroyMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetDlgItem
GetClientRect
GetWindowRect
MapWindowPoints
SendMessageA
EnableWindow
DrawEdge
DrawFrameControl
SetFocus
WaitMessage
PostThreadMessageA
GetComboBoxInfo
MonitorFromPoint
LoadMenuW
CreatePopupMenu
AppendMenuA
DrawTextA
SetForegroundWindow
InvalidateRect
GetWindowTextA
GetParent
MessageBoxA
InSendMessage
UpdateLayeredWindow
DrawIcon
FrameRect
CopyIcon
SetCursorPos
IsZoomed
DrawStateA
SetWindowRgn
SetClassLongA
EnumDisplayMonitors
SetLayeredWindowAttributes
NotifyWinEvent
InvertRect
DrawIconEx
DrawFocusRect
GetNextDlgGroupItem
GetDCEx
GetMenuDefaultItem
LoadImageW
TrackMouseEvent
SetParent
GetDialogBaseUnits
RealChildWindowFromPoint
ShowOwnedPopups
PostQuitMessage
IsRectEmpty
SetMenu
UnionRect
gdi32
ExcludeClipRect
GetClipBox
GetClipRgn
GetCurrentPositionEx
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
OffsetClipRgn
PlayMetaFile
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetBkMode
SetMapperFlags
SetGraphicsMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextCharacterExtra
SetTextAlign
SetTextJustification
PlayMetaFileRecord
EnumMetaFile
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
StartDocA
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
ExtCreatePen
MoveToEx
TextOutA
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CombineRgn
CreateRectRgnIndirect
GetMapMode
PatBlt
Escape
DPtoLP
GetBkColor
CreateFontA
GetCharWidthA
StretchDIBits
GetTextMetricsA
EnumFontFamiliesExA
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
GetDIBits
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
GetRgnBox
OffsetRgn
GetCurrentObject
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
CloseMetaFile
CreateMetaFileA
DeleteMetaFile
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
GetROP2
GetBkMode
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextExtentPointA
GetTextExtentPoint32W
GetTextFaceA
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreateHatchBrush
CreateDIBPatternBrushPt
CreateBitmap
CreateDCA
CopyMetaFileA
ExtTextOutW
BitBlt
GetObjectA
GetTextExtentPoint32A
GetStockObject
CreateFontIndirectA
ExtTextOutA
SetTextColor
SetBkColor
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
SetRectRgn
CreatePen
GetDeviceCaps
msimg32
AlphaBlend
TransparentBlt
winspool.drv
DocumentPropertiesA
OpenPrinterA
ClosePrinter
GetJobA
advapi32
RegEnumKeyA
RegCloseKey
RegCreateKeyA
RegDeleteKeyA
RegSetValueA
RegOpenKeyExA
RegOpenKeyExW
GetFileSecurityA
SetFileSecurityA
RegEnumKeyExA
RegEnumValueA
RegQueryValueA
RegSetValueExA
RegDeleteValueA
RegCreateKeyExA
RegQueryValueExA
shell32
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
Shell_NotifyIconA
SHChangeNotify
SHGetSpecialFolderPathA
SHGetFileInfoA
DragQueryFileA
DragFinish
SHAddToRecentDocs
ExtractIconA
ShellExecuteExA
SHAppBarMessage
SHGetDesktopFolder
SHGetSpecialFolderLocation
ShellExecuteA
comctl32
ImageList_AddMasked
ImageList_BeginDrag
ImageList_EndDrag
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Draw
shlwapi
PathRemoveFileSpecA
PathIsUNCA
PathStripToRootA
UrlUnescapeA
PathCombineA
PathFindFileNameA
PathRemoveExtensionA
PathRemoveFileSpecW
StrFormatKBSizeA
PathFindExtensionA
uxtheme
GetCurrentThemeName
GetThemeColor
DrawThemeText
DrawThemeParentBackground
GetWindowTheme
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
DrawThemeBackground
CloseThemeData
OpenThemeData
IsAppThemed
GetThemeSysColor
ole32
CoRegisterMessageFilter
StgOpenStorageOnILockBytes
StgIsStorageFile
CreateILockBytesOnHGlobal
CreateFileMoniker
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleRegGetMiscStatus
OleRegEnumVerbs
StgCreateDocfileOnILockBytes
WriteClassStm
GetHGlobalFromILockBytes
CreateGenericComposite
CreateItemMoniker
StgOpenStorage
StgCreateDocfile
OleLockRunning
OleSetMenuDescriptor
CLSIDFromProgID
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
CreateStreamOnHGlobal
CLSIDFromString
CoDisconnectObject
StringFromGUID2
CoInitialize
CoCreateGuid
CoCreateInstance
CoInitializeEx
CoUninitialize
SetConvertStg
OleRegGetUserType
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
CreateBindCtx
CoTreatAsClass
WriteClassStg
ReadClassStg
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID
OleCreate
OleCreateFromData
CoRevokeClassObject
CoRegisterClassObject
CoGetClassObject
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
OleQueryCreateFromData
OleQueryLinkFromData
CoGetMalloc
OleIsRunning
GetRunningObjectTable
CreateOleAdviseHolder
CreateDataAdviseHolder
PropVariantCopy
OleRun
OleCreateLinkFromData
OleCreateStaticFromData
OleCreateLinkToFile
OleCreateFromFile
OleLoad
OleSave
OleSaveToStream
OleSetContainedObject
OleGetIconOfClass
oleaut32
SafeArrayGetElemsize
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayGetDim
SafeArrayPtrOfIndex
VariantCopy
VarDateFromStr
VarCyFromStr
VarBstrFromCy
SafeArrayCreate
VarBstrFromDec
VarDecFromStr
SysAllocString
SafeArrayRedim
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayCopy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysReAllocStringLen
SysStringLen
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysAllocStringByteLen
SafeArrayAllocData
SafeArrayDestroyDescriptor
VarBstrFromDate
SysFreeString
SafeArrayAllocDescriptor
SysStringByteLen
oledlg
ord8
gdiplus
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
wininet
InternetGetConnectedState
InternetSetOptionA
InternetAttemptConnect
InternetCrackUrlA
InternetConnectA
InternetSetFilePointer
InternetReadFile
InternetQueryDataAvailable
InternetFindNextFileA
InternetQueryOptionA
InternetGetLastResponseInfoA
InternetSetStatusCallback
FtpFindFirstFileA
InternetOpenUrlA
InternetCloseHandle
InternetOpenA
InternetWriteFile
FtpGetFileA
FtpPutFileA
FtpDeleteFileA
FtpRenameFileA
FtpOpenFileA
FtpSetCurrentDirectoryA
FtpCreateDirectoryA
InternetErrorDlg
InternetGetCookieA
InternetSetCookieA
HttpQueryInfoA
HttpEndRequestA
HttpSendRequestExA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
GopherGetAttributeA
GopherOpenFileA
GopherFindFirstFileA
GopherCreateLocatorA
FtpCommandA
FtpGetCurrentDirectoryA
FtpRemoveDirectoryA
InternetCanonicalizeUrlA
imm32
ImmGetContext
ImmReleaseContext
ImmGetCompositionStringA
ImmGetCompositionStringW
ImmSetCompositionFontA
ImmSetCompositionWindow
ImmGetOpenStatus
ImmGetProperty
oleacc
AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject
Sections
.text Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 606KB - Virtual size: 606KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 41KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 110KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ