Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-07_18eb0bb2c464007dd00ba1d2c9d2746d_icedid_JC.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-07_18eb0bb2c464007dd00ba1d2c9d2746d_icedid_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.2023-09-07_18eb0bb2c464007dd00ba1d2c9d2746d_icedid_JC.exe
-
Size
597KB
-
MD5
18eb0bb2c464007dd00ba1d2c9d2746d
-
SHA1
714a8c66e03c682812c5e094252aba17730e8107
-
SHA256
5671fb9eedd19ccd8f6ee6c2ca037d6d5fef8404cb9e7c692221dc4d253b9bdc
-
SHA512
f794080fb9c567f239d1a004df6c8c68096c792e767573ad458e940e1634009221b99f7373963f8541f1778b7c93b6661fc9f8ca41ae2ef535bb14f6dbe79e3e
-
SSDEEP
6144:+P1aly9EQpETQAoqwE7KpLaYMfXrOv7Ql03kHeqYvbJnFo2EcQOmx0eozB3:+P1jEAaLfyvGQIe5W0eol3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.2023-09-07_18eb0bb2c464007dd00ba1d2c9d2746d_icedid_JC.exe
Files
-
NEAS.2023-09-07_18eb0bb2c464007dd00ba1d2c9d2746d_icedid_JC.exe.exe windows:5 windows x86
4374313211cb3cf01d38c10ac846e46c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenMutexA
CopyFileA
SetCurrentDirectoryA
GetPrivateProfileIntA
GetFileAttributesExA
CompareFileTime
SetUnhandledExceptionFilter
GetFileInformationByHandle
DuplicateHandle
GetFileType
CreateFileMappingA
GetLocalTime
WriteFile
SystemTimeToFileTime
UnmapViewOfFile
MapViewOfFile
SetFilePointer
GetFileSize
FileTimeToDosDateTime
CreateThread
ReleaseMutex
CreateMutexA
LocalFree
CreateToolhelp32Snapshot
LocalAlloc
Process32Next
lstrcmpiA
TerminateProcess
OpenProcess
FormatMessageA
Process32First
lstrlenA
GetWindowsDirectoryA
FileTimeToLocalFileTime
FindClose
FindFirstFileA
GetSystemDirectoryA
FileTimeToSystemTime
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
ExpandEnvironmentStringsA
DeleteFileA
GetSystemTime
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameA
DeleteCriticalSection
CreateIoCompletionPort
GetThreadPriority
PostQueuedCompletionStatus
EnterCriticalSection
SetLastError
GetLastError
SetThreadPriority
GetFileAttributesA
LeaveCriticalSection
InitializeCriticalSection
GetCurrentThread
ReadDirectoryChangesW
GetQueuedCompletionStatus
CreateFileA
LoadLibraryA
ResetEvent
CreateEventA
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
GlobalGetAtomNameA
ResumeThread
SuspendThread
lstrcmpA
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
CompareStringA
GetModuleHandleW
GetVersionExA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalFlags
FlushFileBuffers
SetEndOfFile
InterlockedExchange
GetLocaleInfoA
GetCPInfo
GetOEMCP
HeapFree
HeapAlloc
UnhandledExceptionFilter
IsDebuggerPresent
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
ExitThread
GetCommandLineA
HeapReAlloc
RtlUnwind
RaiseException
VirtualAlloc
HeapSize
ExitProcess
HeapCreate
HeapDestroy
VirtualFree
GetStdHandle
SetHandleCount
GetACP
IsValidCodePage
GetTimeZoneInformation
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
InterlockedCompareExchange
SetEvent
WaitForSingleObject
InterlockedDecrement
InterlockedIncrement
FreeLibrary
CloseHandle
GetModuleHandleA
CreatePipe
LockResource
GetProcAddress
GetStartupInfoA
MultiByteToWideChar
ReadFile
CreateProcessA
SizeofResource
Sleep
WideCharToMultiByte
GetCurrentProcess
LoadResource
CreateFileW
FindResourceA
user32
SetMenu
MapWindowPoints
GetMessagePos
GetMessageTime
GetTopWindow
GetDlgItem
GetForegroundWindow
RemovePropA
GetPropA
SetPropA
GetClassNameA
GetClassLongA
GetCapture
WinHelpA
LoadIconA
RegisterWindowMessageA
SetWindowTextA
ShowWindow
DestroyMenu
PostQuitMessage
IsWindowEnabled
GetWindowTextA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
GetActiveWindow
IsWindowVisible
SendMessageA
GetKeyState
GetCursorPos
ValidateRect
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
SetForegroundWindow
GetClientRect
GetClassInfoExA
GetClassInfoA
AdjustWindowRectEx
CopyRect
GetDlgCtrlID
CallWindowProcA
PtInRect
GetMenu
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
RegisterClassA
DispatchMessageA
PostMessageA
IsWindow
DefWindowProcA
PeekMessageA
GetSysColor
GetSysColorBrush
GetWindowThreadProcessId
GetParent
GetWindowLongA
GetLastActivePopup
MessageBoxA
DestroyWindow
GetMessageA
CreateWindowExA
TranslateMessage
MessageBeep
MsgWaitForMultipleObjects
PostThreadMessageA
EnableWindow
gdi32
DeleteObject
PtVisible
RectVisible
TextOutA
ExtTextOutA
GetDeviceCaps
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
ScaleWindowExtEx
DeleteDC
CreateBitmap
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
SetWindowExtEx
GetStockObject
Escape
advapi32
RegQueryValueExA
AdjustTokenPrivileges
RegOpenKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
ws2_32
gethostbyname
closesocket
socket
recv
setsockopt
htons
WSAGetLastError
connect
WSAStartup
send
dbghelp
MiniDumpWriteDump
sqlite
sqlite3_free
sqlite3_changes
sqlite3_column_type
sqlite3_column_name
sqlite3_close
sqlite3_exec
sqlite3_open
sqlite3_column_count
sqlite3_free_table
sqlite3_column_text
sqlite3_errmsg
sqlite3_busy_timeout
sqlite3_column_int
sqlite3_finalize
sqlite3_step
sqlite3_mprintf
sqlite3_prepare_v2
urlmon
IsValidURL
URLDownloadToFileA
oleacc
LresultFromObject
CreateStdAccessibleObject
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
oleaut32
VariantInit
VariantClear
VariantChangeType
Sections
.text Size: 491KB - Virtual size: 490KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 77KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 27KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ