Analysis
-
max time kernel
147s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 20:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.2023-09-09_1c08ab1e0433036e6c29a1a40d32e950_icedid_JC.exe
Resource
win7-20231023-en
windows7-x64
9 signatures
150 seconds
General
-
Target
NEAS.2023-09-09_1c08ab1e0433036e6c29a1a40d32e950_icedid_JC.exe
-
Size
1.5MB
-
MD5
1c08ab1e0433036e6c29a1a40d32e950
-
SHA1
c58454e7dc243d9f7b579666d24df45fd7a5fd5e
-
SHA256
3361846ca417b165a9329423adb1e4d7901f90a9153d5754245cce49cb7b4b2b
-
SHA512
efc9544a34d15430cee80f12866faea2a9cb7e2fe503314cd36ed3fadf595cae38d36ba343af735c5261a0268e1d4b8b7b2565cbfcb8aaa199bad74bf1ae5c4f
-
SSDEEP
24576:cygqNoiSmpoRIMpn4LWmzKeMtEN0LnMhHm8sIKbXppw:chqBSmpoRIMpn4SmzKeMtEN0LnmGZNbL
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation NEAS.2023-09-09_1c08ab1e0433036e6c29a1a40d32e950_icedid_JC.exe -
Executes dropped EXE 1 IoCs
pid Process 736 7C73.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NEAS.2023-09-09_1c08ab1e0433036e6c29a1a40d32e950_icedid_JC.exe -
Drops file in System32 directory 53 IoCs
description ioc Process File created C:\Windows\SysWOW64\msvbvm60.dll 7C73.tmp File created C:\Windows\SysWOW64\odbcjt32.dll 7C73.tmp File created C:\Windows\SysWOW64\olesvr32.dll 7C73.tmp File created C:\Windows\SysWOW64\ir50_32original.dll 7C73.tmp File opened for modification C:\Windows\SysWOW64\mfc120.dll 7C73.tmp File created C:\Windows\SysWOW64\mfc40.dll 7C73.tmp File opened for modification C:\Windows\SysWOW64\opencl.dll 7C73.tmp File opened for modification C:\Windows\SysWOW64\atl100.dll 7C73.tmp File opened for modification C:\Windows\SysWOW64\atl110.dll 7C73.tmp File created C:\Windows\SysWOW64\ir32_32original.dll 7C73.tmp File opened for modification C:\Windows\SysWOW64\mfc120u.dll 7C73.tmp File opened for modification C:\Windows\SysWOW64\msvcr120.dll 7C73.tmp File created C:\Windows\SysWOW64\sqlunirl.dll 7C73.tmp File created C:\Windows\SysWOW64\msjet40.dll 7C73.tmp File created C:\Windows\SysWOW64\msvcrt20.dll 7C73.tmp File created C:\Windows\SysWOW64\mswstr10.dll 7C73.tmp File opened for modification C:\Windows\SysWOW64\concrt140.dll 7C73.tmp File created C:\Windows\SysWOW64\expsrv.dll 7C73.tmp File opened for modification C:\Windows\SysWOW64\mfc110u.dll 7C73.tmp File created C:\Windows\SysWOW64\crtdll.dll 7C73.tmp File created C:\Windows\SysWOW64\hh.exe 7C73.tmp File created C:\Windows\SysWOW64\iac25_32.ax 7C73.tmp File opened for modification C:\Windows\SysWOW64\vccorlib120.dll 7C73.tmp File created C:\Windows\SysWOW64\d3dim.dll 7C73.tmp File created C:\Windows\SysWOW64\ir41_32original.dll 7C73.tmp File created C:\Windows\SysWOW64\mfc40u.dll 7C73.tmp File created C:\Windows\SysWOW64\OneDriveSetup.exe 7C73.tmp File opened for modification C:\Windows\SysWOW64\PrintConfig.dll 7C73.tmp File created C:\Windows\SysWOW64\ivfsrc.ax 7C73.tmp File opened for modification C:\Windows\SysWOW64\mfc140.dll 7C73.tmp File created C:\Windows\SysWOW64\msxbde40.dll 7C73.tmp File created C:\Windows\SysWOW64\msrd3x40.dll 7C73.tmp File created C:\Windows\SysWOW64\sqlwoa.dll 7C73.tmp File created C:\Windows\SysWOW64\d3dxof.dll 7C73.tmp File opened for modification C:\Windows\SysWOW64\mfc140u.dll 7C73.tmp File created C:\Windows\SysWOW64\msorcl32.dll 7C73.tmp File created C:\Windows\SysWOW64\mspbde40.dll 7C73.tmp File created C:\Windows\SysWOW64\AppVEntSubsystems32.dll 7C73.tmp File opened for modification C:\Windows\SysWOW64\msvcr110.dll 7C73.tmp File created C:\Windows\SysWOW64\msrepl40.dll 7C73.tmp File created C:\Windows\SysWOW64\olecli32.dll 7C73.tmp File created C:\Windows\SysWOW64\rdvgogl32.dll 7C73.tmp File created C:\Windows\SysWOW64\FXSXP32.dll 7C73.tmp File created C:\Windows\SysWOW64\gnsdk_fp.dll 7C73.tmp File created C:\Windows\SysWOW64\msexch40.dll 7C73.tmp File created C:\Windows\SysWOW64\d3d8.dll 7C73.tmp File opened for modification C:\Windows\SysWOW64\mfc100.dll 7C73.tmp File opened for modification C:\Windows\SysWOW64\mfc100u.dll 7C73.tmp File created C:\Windows\SysWOW64\msjtes40.dll 7C73.tmp File opened for modification C:\Windows\SysWOW64\vcomp140.dll 7C73.tmp File created C:\Windows\SysWOW64\acwow64.dll 7C73.tmp File opened for modification C:\Windows\SysWOW64\mfc110.dll 7C73.tmp File opened for modification C:\Windows\SysWOW64\msvcr100.dll 7C73.tmp -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 7C73.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\mfc140u.dll 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ONLNTCOMLIB.DLL 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\ADAL.DLL 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Csi.dll 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHEV.DLL 7C73.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libcef.dll 7C73.tmp File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 7C73.tmp File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\mfc140u.dll 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\msvcr120.dll 7C73.tmp File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso30win32client.dll 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\msmdlocal.dll 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\IEAWSDC.DLL 7C73.tmp File opened for modification C:\Program Files\7-Zip\7z.sfx 7C73.tmp File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll 7C73.tmp File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 7C73.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 7C73.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso50win32client.dll 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\PPSLAX.DLL 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\URLREDIR.DLL 7C73.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\Flash.mpp 7C73.tmp File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Temp NEAS.2023-09-09_1c08ab1e0433036e6c29a1a40d32e950_icedid_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\msolui.dll 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OWSCLT.DLL 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\msoshext.dll 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 7C73.tmp File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll 7C73.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Search.api 7C73.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\logsession.dll 7C73.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 7C73.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libGLESv2.dll 7C73.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm.api 7C73.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\MakeAccessible.api 7C73.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PPKLite.api 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso40UIwin32client.dll 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\mfc140u.dll 7C73.tmp File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 7C73.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\adoberfp.dll 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\MSVCR110.DLL 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\mfc140.dll 7C73.tmp File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 7C73.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll 7C73.tmp File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OWSSUPP.DLL 7C73.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvSOFT.x3d 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\concrt140.dll 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll 7C73.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\rt3d.dll 7C73.tmp File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_bho.dll 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL 7C73.tmp File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 7C73.tmp File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\NAMEEXT.DLL 7C73.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 7C73.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvDX9.x3d 7C73.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSO.DLL 7C73.tmp -
Drops file in Windows directory 62 IoCs
description ioc Process File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroPDFImpl.dll 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ReadOutLoud.api 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\rt3d.dll 7C73.tmp File created C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroForm.api__NON_OPT 7C73.tmp File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\MCIMPP.mpp 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\WindowsMedia.mpp 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\00006109E70000000100000000F01FEC\16.0.12527\concrt140.dll_x86 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adobearmhelper.exe.BDCA7721_F290_4124_BBED_7A15FE7694EB 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\drvSOFT.x3d 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\SendMail.api 7C73.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SecStoreFile.ico 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_atl100_x86 7C73.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\APIFile_8.ico 7C73.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SC_Reader.ico 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroPDF.dll 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Bib.dll_NON_OPT 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\PPKLite.api 7C73.tmp File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrocef.exe.15EE1C08_ED51_465D_B6F3_FB152B1CC435 7C73.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\PDFFile_8.ico 7C73.tmp File created C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.dll 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\nppdf32.dll 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Ace.dll_NON_OPT 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.exe 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Search.api 7C73.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\FDFFile_8.ico 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_msvcr100_x86 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\libcef.dll.15EE1C08_ED51_465D_B6F3_FB152B1CC435 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\SaveAsRTF.api_NON_OPT 7C73.tmp File created C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Annots.api 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\drvDX9.x3d 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adobearm.exe.BDCA7721_F290_4124_BBED_7A15FE7694EB 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AGM.dll 7C73.tmp File created C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\wpfgfx_v0300.dll 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\EScript.api 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA 7C73.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\PDXFile_8.ico 7C73.tmp File created C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adoberfp.dll 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Multimedia.api_NON_OPT 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\QuickTime.mpp 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 7C73.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\XDPFile_8.ico 7C73.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\XFDFFile_8.ico 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100_x86 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Accessibility.api_NON_OPT 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logsession.dll 7C73.tmp File created C:\Windows\Microsoft.NET\assembly\GAC_32\napcrypt\v4.0_10.0.0.0__31bf3856ad364e35\NAPCRYPT.DLL 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100u_x86 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Flash.mpp 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\nppdf32.dll_Apollo 7C73.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\sqlite.dll 7C73.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 NEAS.2023-09-09_1c08ab1e0433036e6c29a1a40d32e950_icedid_JC.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a NEAS.2023-09-09_1c08ab1e0433036e6c29a1a40d32e950_icedid_JC.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a NEAS.2023-09-09_1c08ab1e0433036e6c29a1a40d32e950_icedid_JC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4304 NEAS.2023-09-09_1c08ab1e0433036e6c29a1a40d32e950_icedid_JC.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4304 wrote to memory of 736 4304 NEAS.2023-09-09_1c08ab1e0433036e6c29a1a40d32e950_icedid_JC.exe 82 PID 4304 wrote to memory of 736 4304 NEAS.2023-09-09_1c08ab1e0433036e6c29a1a40d32e950_icedid_JC.exe 82 PID 4304 wrote to memory of 736 4304 NEAS.2023-09-09_1c08ab1e0433036e6c29a1a40d32e950_icedid_JC.exe 82 PID 4304 wrote to memory of 3548 4304 NEAS.2023-09-09_1c08ab1e0433036e6c29a1a40d32e950_icedid_JC.exe 87 PID 4304 wrote to memory of 3548 4304 NEAS.2023-09-09_1c08ab1e0433036e6c29a1a40d32e950_icedid_JC.exe 87 PID 4304 wrote to memory of 3548 4304 NEAS.2023-09-09_1c08ab1e0433036e6c29a1a40d32e950_icedid_JC.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-09_1c08ab1e0433036e6c29a1a40d32e950_icedid_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-09_1c08ab1e0433036e6c29a1a40d32e950_icedid_JC.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmpC:\Users\Admin\AppData\Local\Temp\7C73.tmp2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:736
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"2⤵PID:3548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102B
MD5c42592fd019ec4a186471c670ded3b4f
SHA12d5a5b980279b0305441b007778a31c18e84cfb7
SHA256e1be6c6777630139171e4e3e74eaf0f8c0ea3a9fb92e1c76b64fc2ff18a8f1a6
SHA512dc22dbfd7fd36284002bcaa73c2224d42afa850123dedac16c37ac48abddebf6d0c7db1d02793dcc9553d226de60a2cad8075a03be7efb4caa29e92157bb36d5
-
Filesize
824B
MD5730cdc49a49dc278867956cc11e8fad3
SHA14cf2bf16c29ae4538ba552700533463575edde28
SHA256c62557ca2d044a3b9ebd39042dcf529c783de02b64e466462aa6cb35d24135a9
SHA512d9b58266132179c39e62a84ad80f32dd3836310b09c2c7b231137a7c70a6c343994466b0579248878f626fa849b3cea3ccbbe7a10c6967bec922241904f215ee
-
Filesize
1.0MB
MD5ab69c49c8d15fb8cfbace8df5bf86720
SHA121339cb4c04a9adb5b9b2ec2ef1808858755f3ee
SHA256af870f5744bbe3719ecef8155bc5cb07bcfc512915a94c87995a8735aa86eb53
SHA5125d06b4fe8d783797daa19b4df09bdf31397b830b2f85fe73e76f7f8cc781c19b42220b3ec8ac6a4353a4f1c04bbc6d76c7f13cb1178d25125d28503216e3b8f4
-
Filesize
722KB
MD5528e102b94187324b6689f07d0c0d8c8
SHA1b6cdc77f872466834dc2eea46d23a9e6e5e2f4c8
SHA256dba63d70bfa3acb406dcaa3df249fcebfdaa3bd7bd4dcef94d3ebde45c68011f
SHA51217cb8d421bfaabd92a2c259ddf101535036698a93562d6d23531606089ba876de9193eb34c1c833c4c79eb12930a624ce784a2a873d04e10d5f050cf064e93a8
-
Filesize
14KB
MD50162a7a6ca55dd442e64f02c36187314
SHA124392ff794633445f4fe12a8a422046d24d67482
SHA2565aa41c7e3160dca492317182e2cf5ad947e91457b5d4a39fc5d7aabcc0c9dd8c
SHA51236e1fa17e868670b433206734fe028ce6b05dc3c6266c557342152fb3cb1984455fe6a9345c877eff394bf6959c6130a861ce7f30004d23c4a580227256a6332
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_EB45B4DDD2CA201E87E40B2FB5245AEF
Filesize727B
MD5b01fdcb757f9877db63e68187da1560a
SHA1408f80de0500eccb9ea80909507833ecb6d239ce
SHA2569acfb4f176cf044c6ce03f0c9ba349e9517bdc65da4bb75522804162a33d5e7d
SHA5121d469f43855865a4b814cda39af2d86a679d27b306b7c5921ef2975a84e43e71d7a8347ac914bebb3fd00e18187da6d8847f600c20877d6e03def216f20f4f54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_EB45B4DDD2CA201E87E40B2FB5245AEF
Filesize404B
MD5afee251e5cb26bd5fbefdc4fc4cdef74
SHA12a0bab9ce96ffafe44cd9e09ab231f7eff947f1c
SHA25602fa1af1439c2fc5be5b91396781fc75fba7b680544bae45e710d06f936432e2
SHA5123f974fb1e572c65922df0443d038257d140a0cb0fd0bf5b271cfdb5a54ea76ceeb7cd4ea9f34fa4b7fa9e9e3bf66502a82cca069734e59c2b9f6a74bf54b61b2
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666
-
Filesize
851B
MD5e1ee532a5fd3708e7674e59f57305c0e
SHA1758e8928d1874de148e30be977bc96a95610cb7e
SHA256d87845b0bb7738189cbad2e20d14c617232956db2c54bb8adb93f31111cdbe5d
SHA512897d7a43b0cb19ced3114d695d693907a52305e18d4d4e395a7a601aa37442329b507df3ee54a065bb7c9d910b01bf6415e9d3e37863bbda75f741e55ba40ee5
-
Filesize
251KB
MD5864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA256b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
SHA512ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
-
Filesize
5KB
MD50506c57d057311fb3d526022032b6bab
SHA140202b53acb34a1962236627556bdce239b9e263
SHA2569f4455b1815bddb9bb1bef7e4ab7844366e49d69f468751a4daa6ca0606181b0
SHA512496c2e899dcc6768d4074201155ee29e3b07e9477bc800ce3b0602d165ebe5b076b615afa4503fdf5ba780433a15587529760ab857295a3fade6bf23ed6e4253
-
Filesize
5KB
MD5c0ed84b61e496418b6e12b0bc28dda6a
SHA160e9f9c880f7f59ff2efeb868aa7a31e5de78da0
SHA2567bc6298d934f138dfee6dc38271d7185ee48a3feabb4397b6659801178e6df55
SHA512bcf4b63934003c07c75dddc422715388ec68a1219b30830d10ba3f8c2848f484c0b7f29f9e24738313dea3c298b5100bfb257a5d40277fdb1e20095dbfc4d6dd
-
Filesize
3KB
MD5fc2430057cb1be74c788f10c2d4540c8
SHA1cab67ee8d5191fbf9f25545825e06c1a822af2f2
SHA256dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
SHA5124e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
-
Filesize
3KB
MD5a58599260c64cb41ed7d156db8ac13ef
SHA1fb9396eb1270e9331456a646ebf1419fc283dc06
SHA256aabf92089e16fdb28706356dbc4efb5a81f5277946f2e67695b31676616ed2d2
SHA5126970cbc42e7ec64ccdb8e5633b7017b1e9ec0d4ad094869e221e9275b814b1442b84827996190159543bdb5e86df6885c45197c533d657db4660fca8ad761a71