2024-01-10_8c498769124d8edd0f7d02c64d4baaad_icedid_sedreco

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-10_8c498769124d8edd0f7d02c64d4baaad_icedid_sedreco
Size

2.9MB
MD5

8c498769124d8edd0f7d02c64d4baaad
SHA1

12d1583400c30d88c9bea4ff7b9e81f81ebcb091
SHA256

153c90f6bb5195f434a80c6e5fc9c3edb1525550d9de25bb5c5715a7caec428b
SHA512

880b3f639ace040985573e5d475f87ff9bfcb9f1e7794eec03ec0fef8cbc456291d25766be8a6d65bf5a12e36cd7776cb4150666e98382a35ff46ee7becb48c3
SSDEEP

49152:3mEBmCkQxw3k+dzZL4T57qVfjZBulEsEho/OJ8eHYNWxRZCg7yXtyx1Dp/r3:3XBmCkcw3kwZLA57qFlslVEho/q8FNW9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-01-10_8c498769124d8edd0f7d02c64d4baaad_icedid_sedreco

Files

2024-01-10_8c498769124d8edd0f7d02c64d4baaad_icedid_sedreco
.exe windows:6 windows x86 arch:x86

c3cc4712e95c2577ad6bb0666bd72216

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegOpenKeyExW
RegFlushKey
OpenProcessToken
SetEntriesInAclW
DeregisterEventSource
ReportEventA
RegisterEventSourceA
RegQueryValueExW
LookupPrivilegeValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
SetServiceStatus
RegisterServiceCtrlHandlerExW
DeleteService
StartServiceCtrlDispatcherW
CloseServiceHandle
ControlService
OpenServiceW
OpenSCManagerW
ImpersonateLoggedOnUser
CreateProcessAsUserW
SetTokenInformation
DuplicateTokenEx
ConvertSidToStringSidW
RegSetValueExW
RevertToSelf
GetTokenInformation
SetSecurityInfo
AdjustTokenPrivileges

kernel32

FindFirstFileExW
GetDriveTypeW
GetExitCodeProcess
SetConsoleMode
GlobalFree
DeleteCriticalSection
FindNextFileW
FindClose
FindFirstFileW
Beep
GetVersion
ReadConsoleInputA
K32GetProcessImageFileNameW
GetCurrentThreadId
SetUnhandledExceptionFilter
GetModuleFileNameW
HeapFree
GetProcessHeap
HeapAlloc
ProcessIdToSessionId
ReadProcessMemory
GetSystemInfo
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
WaitForSingleObject
DuplicateHandle
OpenProcess
LocalFree
GetCurrentProcess
GetVersionExW
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
GetSystemTime
InitializeCriticalSection
MultiByteToWideChar
WriteFile
SetFilePointer
CreateFileW
WideCharToMultiByte
GetSystemDirectoryW
GetTickCount
SetThreadPriority
FreeLibrary
LoadLibraryW
GetModuleHandleW
GetProcAddress
lstrcpynW
Sleep
CreateThread
GetLastError
CreateMutexW
CloseHandle
FindResourceW
LoadResource
LockResource
SizeofResource
WTSGetActiveConsoleSessionId
InitializeCriticalSectionEx
GetFileInformationByHandle
GlobalAlloc
GlobalSize
GlobalLock
GlobalUnlock
MulDiv
FormatMessageW
CopyFileW
SetLastError
InitializeCriticalSectionAndSpinCount
lstrcmpA
GlobalGetAtomNameW
FileTimeToSystemTime
InterlockedDecrement
InterlockedIncrement
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalAlloc
LocalReAlloc
GetFileAttributesW
OutputDebugStringA
GetModuleHandleA
GlobalFlags
lstrcmpW
GlobalAddAtomW
FlushFileBuffers
GetFileSize
GetFullPathNameW
GetVolumeInformationW
LockFile
ReadFile
SetEndOfFile
UnlockFile
LoadLibraryExW
lstrcmpiW
LoadLibraryA
EncodePointer
DecodePointer
CompareStringW
GetUserDefaultUILanguage
ResumeThread
FreeResource
GlobalDeleteAtom
GlobalFindAtomW
InterlockedExchange
FileTimeToLocalFileTime
GetFileAttributesExW
GetFileSizeEx
GetFileTime
GetCurrentDirectoryW
lstrcpyW
GetWindowsDirectoryW
VerSetConditionMask
VerifyVersionInfoW
GetTempFileNameW
GetTempPathW
GetProfileIntW
SearchPathW
VirtualProtect
FindResourceExW
GetCommandLineW
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
SetConsoleCtrlHandler
HeapReAlloc
RtlUnwind
RaiseException
HeapSize
HeapQueryInformation
ExitThread
VirtualAlloc
VirtualQuery
SetStdHandle
GetFileType
GetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
GetStartupInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
GetConsoleCP
OutputDebugStringW
GetDateFormatW
GetTimeFormatW
LCMapStringW
WriteConsoleW
SetEnvironmentVariableA
SleepEx
FormatMessageA
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
VirtualFree
GlobalMemoryStatus
GetVersionExA
FlushConsoleInputBuffer

user32

GetTopWindow
LoadIconW
SetScrollInfo
GetScrollInfo
WinHelpW
GetMonitorInfoW
PostQuitMessage
IsIconic
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
InflateRect
IntersectRect
GetMenuItemInfoW
SystemParametersInfoW
CopyImage
SendDlgItemMessageA
ShowOwnedPopups
SetCursor
DeleteMenu
CreateDialogIndirectParamW
GetNextDlgTabItem
GetNextDlgGroupItem
SetCapture
ReleaseCapture
WindowFromPoint
DrawFocusRect
SetRectEmpty
OffsetRect
IsRectEmpty
DrawIconEx
GetIconInfo
MessageBeep
GetAsyncKeyState
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
GetMenuDefaultItem
LoadMenuW
SetLayeredWindowAttributes
EnumDisplayMonitors
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
DrawEdge
DrawFrameControl
SetWindowRgn
UnionRect
IsMenu
UpdateLayeredWindow
MonitorFromPoint
BringWindowToTop
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetKeyNameTextW
TrackMouseEvent
GetComboBoxInfo
IsZoomed
PostThreadMessageW
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetCursorPos
SetRect
LockWindowUpdate
SetClassLongW
GetDoubleClickTime
GetClassLongW
SetMenuDefaultItem
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
ShowScrollBar
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
IsClipboardFormatAvailable
GetUpdateRect
SubtractRect
CreateMenu
MapDialogRect
DestroyCursor
GetWindowRgn
DrawIcon
GetUserObjectInformationW
GetProcessWindowStation
IsDialogMessageW
TranslateMessage
DispatchMessageW
ShowWindow
GetScrollRange
SetScrollRange
ScrollWindow
RedrawWindow
PostMessageW
CreateDialogParamW
LoadImageW
GetSystemMetrics
DestroyIcon
GetSystemMenu
AppendMenuW
SendMessageW
SetActiveWindow
UpdateWindow
SetMenu
GetMenu
GetCapture
EndDeferWindowPos
GetMessageW
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsChild
GetClassInfoExW
GetClassInfoW
CallWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
FillRect
ScreenToClient
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
CallNextHookEx
SetWindowsHookExW
ValidateRect
GetActiveWindow
CharUpperW
RealChildWindowFromPoint
PtInRect
ClientToScreen
SetWindowLongW
GetFocus
GetDlgCtrlID
EqualRect
CopyRect
MapWindowPoints
AdjustWindowRectEx
RemovePropW
GetPropW
CopyIcon
SetPropW
MoveWindow
IsWindow
GetWindow
GetScrollPos
DeferWindowPos
SetScrollPos
GetLastActivePopup
GetParent
GetWindowLongW
IsWindowEnabled
GetSysColorBrush
GetSysColor
EnumWindowStationsW
OpenWindowStationW
EnumDesktopsW
OpenDesktopW
GetWindowInfo
IsDlgButtonChecked
CheckDlgButton
EnumDesktopWindows
GetClassNameW
SetFocus
VkKeyScanW
SetKeyboardState
GetKeyboardState
SendInput
MapVirtualKeyW
GetKeyState
PeekMessageW
keybd_event
EndPaint
DrawTextW
GetClientRect
SetWindowPos
GetWindowRect
SetParent
GetDesktopWindow
BeginPaint
DefWindowProcW
KillTimer
SetTimer
InvalidateRect
CreateWindowExW
RegisterClassW
LoadCursorW
DestroyWindow
LoadStringW
MonitorFromWindow
GetForegroundWindow
FindWindowW
MessageBoxA
EnumWindows
GetWindowThreadProcessId
EndDialog
MessageBoxW
GetWindowTextW
DialogBoxParamW
DestroyMenu
TrackPopupMenu
SetForegroundWindow
InsertMenuW
IsWindowVisible
CreatePopupMenu
GetCursorPos
EnableWindow
SetWindowTextW
GetDlgItem
ReleaseDC
GetDC
UnhookWindowsHookEx
GetWindowTextLengthW
RemoveMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
FrameRect
GetMenuStringW

gdi32

CreateHatchBrush
CreatePen
CreatePatternBrush
CreateRectRgn
DeleteDC
Escape
ExcludeClipRect
GetClipBox
GetObjectType
GetPixel
GetStockObject
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
CreateCompatibleDC
CreateBitmap
BitBlt
GetDeviceCaps
GetTextFaceW
GetViewportOrgEx
LPtoDP
GetWindowOrgEx
GetBoundsRect
FillRgn
SetPaletteEntries
ExtFloodFill
SetPixelV
PtInRegion
FrameRgn
RoundRect
CreateRoundRectRgn
OffsetRgn
GetRgnBox
EnumFontFamiliesExW
Rectangle
Polyline
Polygon
CreatePolygonRgn
GetTextColor
Ellipse
CreateEllipticRgn
SetDIBColorTable
CreateDIBSection
StretchBlt
SetPixel
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
CreateCompatibleBitmap
GetBkColor
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
CreateSolidBrush
SelectObject
PatBlt
SetBkColor
DeleteObject
SetBkMode
CreateFontW
SetTextColor
GetNearestPaletteIndex
CreatePalette
GetTextMetricsW
GetTextExtentPoint32W
DPtoLP
SetRectRgn
CreateRectRgnIndirect
CreateFontIndirectW
CombineRgn
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
CreateDCW
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
MoveToEx
GetObjectW
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
CopyMetaFileW

shell32

SHAppBarMessage
SHGetKnownFolderPath
Shell_NotifyIconW
SHBrowseForFolderW
DragFinish
DragQueryFileW
SHGetDesktopFolder
SHGetFileInfoW
ShellExecuteW
SHGetSpecialFolderLocation
SHGetPathFromIDListW

ole32

OleDuplicateData
ReleaseStgMedium
CreateStreamOnHGlobal
CoAllowSetForegroundWindow
CoInitializeEx
CoUninitialize
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
CoCreateInstance
CoInitialize
CoTaskMemAlloc
DoDragDrop
CoTaskMemFree

msimg32

TransparentBlt
AlphaBlend

comctl32

ord17

shlwapi

PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathFindExtensionW
PathRemoveFileSpecW
StrFormatKBSizeW

uxtheme

DrawThemeBackground
OpenThemeData
GetCurrentThemeName
IsAppThemed
DrawThemeParentBackground
GetThemeColor
CloseThemeData
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
GetWindowTheme
GetThemePartSize
DrawThemeText

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

gdiplus

GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipGetImageHeight

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

winmm

PlaySoundW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

wtsapi32

WTSQueryUserToken

wininet

InternetQueryOptionW
InternetSetOptionW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

oleaut32

VarBstrFromDate
SysFreeString
SysAllocStringLen
VariantInit
SysAllocString
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantClear
VariantChangeType

ws2_32

ioctlsocket
WSACleanup
htonl
shutdown
gethostbyaddr
gethostbyname
gethostname
WSAStartup
sendto
recvfrom
listen
accept
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSAGetLastError

wldap32

ord32
ord46
ord301
ord200
ord30
ord79
ord35
ord33
ord143
ord27
ord26
ord22
ord41
ord50
ord60
ord211

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 633KB - Virtual size: 632KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c3cc4712e95c2577ad6bb0666bd72216

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

gdi32

shell32

ole32

msimg32

comctl32

shlwapi

uxtheme

oleacc

gdiplus

imm32

winmm

userenv

rpcrt4

wtsapi32

wininet

winspool.drv

oleaut32

ws2_32

wldap32

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 633KB - Virtual size: 632KB

.data Size: 80KB - Virtual size: 2.5MB

.rsrc Size: 11KB - Virtual size: 11KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 633KB - Virtual size: 632KB

.data
Size: 80KB - Virtual size: 2.5MB

.rsrc
Size: 11KB - Virtual size: 11KB