Behavioral task
behavioral1
Sample
2024-01-06_5376f23530764d40a233fd2d5a633789_icedid.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-06_5376f23530764d40a233fd2d5a633789_icedid.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-06_5376f23530764d40a233fd2d5a633789_icedid
-
Size
13KB
-
MD5
5376f23530764d40a233fd2d5a633789
-
SHA1
2e7a928a07c008670838a92ca086e795b142deb7
-
SHA256
90a4d2906ec8ea874e586b5f39e01bc1db265622797f5885bc83dadb8f6bf6d0
-
SHA512
20bb8bb8975b8105974bbafcb578179e67958d46f6dc44065d81cbb7217988a3e7bc02712a9bcff95fee9e618f69e1a6ca1cb065e1a949f51304978be03f70b5
-
SSDEEP
192:caBnU7ThdZzpk4EJmxQQTHGKZFTkUV2U+A5+ZrCi5x38xf+rs:caBUn3Zz6mxQNqNVH+A5+ZrCi2f+rs
Malware Config
Extracted
icedid
Signatures
-
Icedid family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-06_5376f23530764d40a233fd2d5a633789_icedid
Files
-
2024-01-06_5376f23530764d40a233fd2d5a633789_icedid.exe windows:6 windows x64 arch:x64
7da7944dd09a50ac9764ef71fea6691a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shell32
SHGetFolderPathA
msvcrt
memset
winhttp
WinHttpOpenRequest
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpSetStatusCallback
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
kernel32
HeapReAlloc
WideCharToMultiByte
lstrlenW
VirtualProtect
VirtualAlloc
lstrcatA
lstrcpyA
CreateDirectoryA
LoadLibraryA
GetProcAddress
GetComputerNameExW
GetTickCount64
SwitchToThread
CreateFileA
ReadFile
GetTempPathA
CloseHandle
WaitForSingleObject
Sleep
ExitProcess
CreateThread
GetTickCount
WriteFile
HeapAlloc
HeapFree
GetProcessHeap
GetLastError
advapi32
GetUserNameW
LookupAccountNameW
user32
wsprintfW
wsprintfA
Sections
.c Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 6B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.r Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.d Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE