Static task
static1
Behavioral task
behavioral1
Sample
2024-01-10_bce9170b1906ab1cdee87a1a4389c4a9_icedid_winnti.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-10_bce9170b1906ab1cdee87a1a4389c4a9_icedid_winnti.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-10_bce9170b1906ab1cdee87a1a4389c4a9_icedid_winnti
-
Size
11.5MB
-
MD5
bce9170b1906ab1cdee87a1a4389c4a9
-
SHA1
839fcfbe08bd520a4a8e5359f162246229d50f6e
-
SHA256
126ee748d5297f04212f6450033219253532b10dc246af4848f0f1735fe4ceb6
-
SHA512
7475c181bc3328dbde6f1c37badd3c72e27a70d7a9a8b3f8e1a48b3d7bb5ba4d8841ad00f38972730831d05effd37df5ce7a4f8f7c49c1861ba5baa75a7e4dcc
-
SSDEEP
196608:UbJSrqzQ3lDFty+FpxL4/1p5CcZ2ZVMmtMGRrEt68dLaVV0qjryfTvsDEeonYq7V:BrGQVHy+FvL4/17CcEZVMmtMGlI68mHt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-10_bce9170b1906ab1cdee87a1a4389c4a9_icedid_winnti
Files
-
2024-01-10_bce9170b1906ab1cdee87a1a4389c4a9_icedid_winnti.exe windows:6 windows x86 arch:x86
ef1e60959c05cd24fa90d91708cc2efb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
dbghelp
MiniDumpWriteDump
ugdll
showgrid_GetVersionNumber
showgrid_CloseGrid
showgrid_UpdateGrid
showgrid_UpdateStatusBarText
showgrid_SetUpdateContent
showgrid_UpdateFont
showgrid_UpdateHighlightColor
showgrid_AddToSelection
showgrid_OpenGrid
showgrid_RepaintGrid
showgrid_ExpandOrCollapse
showgrid_ClearSelection
showgrid_SaveExpandSettings
showgrid_AdjustCurrentColumnWidth
showgrid_UnjoinCells
showgrid_UpdateExpandGrid
showgrid_BestFit
showgrid_UpdateEditText
showgrid_GetHandleFromViewList
showgrid_CloseChoosePlan
showgrid_OpenChoosePlan
showgrid_CancelChoosePlan
showgrid_GetCurrentChoosePlanHandle
showgrid_HideListView
showgrid_CleanAutofilterGrid
showgrid_UpdateViewListAfterReferChoose
showgrid_GetLayoutStructFromViewlist
showgrid_UpdateListView
settings_SetMaximumGridColorAdjustment
showgrid_UpdateChangeViewList
settings_SetGridColorationPeriod
settings_GetViewScreenInfoFile
showgrid_GetCurrentRow
showgrid_GotoRow
showgrid_ExpandAll
showgrid_RedrawGrid
showgrid_CloseListView
settings_SetPrefilledFieldsInChangeValueView
showgrid_SetUpdateSideHeaderOnly
showgrid_SetFocusGrid
showgrid_CollapseAll
showgrid_OpenListView
kernel32
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SleepEx
GetTickCount
lstrcpynA
GetVersionExA
FileTimeToDosDateTime
VirtualQuery
GlobalMemoryStatus
GetProcessHeap
DeleteCriticalSection
GetFileSize
HeapDestroy
DecodePointer
HeapAlloc
GetSystemInfo
RaiseException
HeapReAlloc
lstrcpyA
HeapSize
lstrcatA
GetCurrentDirectoryA
lstrlenA
InitializeCriticalSectionEx
SetFilePointer
OutputDebugStringA
WriteFile
HeapFree
GetModuleFileNameA
K32GetProcessMemoryInfo
CompareFileTime
WideCharToMultiByte
MultiByteToWideChar
GetPrivateProfileStringA
CopyFileA
GetFileAttributesExA
WritePrivateProfileSectionA
WritePrivateProfileStringA
CreateEventW
WaitForSingleObjectEx
ResetEvent
LocalUnlock
LocalLock
ReplaceFileA
GetDiskFreeSpaceA
SearchPathA
GetProfileIntA
GetTempFileNameA
GetExitCodeThread
VerifyVersionInfoA
VerSetConditionMask
GetWindowsDirectoryA
FindResourceExW
GetPrivateProfileIntA
SetErrorMode
SetFileTime
SetFileAttributesA
LocalFileTimeToFileTime
GetPrivateProfileSectionA
FreeLibrary
GetProcAddress
LoadLibraryA
MulDiv
GetFileInformationByHandle
MoveFileA
GetFileTime
SystemTimeToTzSpecificLocalTime
CreateFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
Sleep
GetLocaleInfoA
FindClose
FindNextFileA
FindFirstFileA
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetExitCodeProcess
FormatMessageA
CreateProcessA
WinExec
LocalFree
CloseHandle
SetDllDirectoryA
CreateThread
GetLastError
ReleaseMutex
WaitForSingleObject
CreateMutexA
TerminateProcess
GetSystemTime
GlobalFree
GetTempPathA
SetCurrentDirectoryA
VirtualAlloc
ExitThread
GetFileSizeEx
GetFileAttributesA
VirtualProtect
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GlobalFlags
GetStringTypeExA
GetVolumeInformationA
lstrcmpiA
GetShortPathNameA
LoadLibraryExA
DuplicateHandle
UnlockFile
LockFile
DeleteFileA
FreeLibraryAndExitThread
HeapQueryInformation
QueryPerformanceFrequency
GlobalFindAtomA
GlobalAddAtomA
FindResourceA
lstrcmpW
GlobalDeleteAtom
FreeResource
GetSystemDirectoryW
GetThreadLocale
SystemTimeToFileTime
GetAtomNameA
GlobalGetAtomNameA
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
GetACP
GetFullPathNameW
GetFullPathNameA
CreateFileW
GetFileType
GetDriveTypeW
GetLocalTime
ReadFile
FindFirstFileExW
FindNextFileW
GetTimeZoneInformation
WriteConsoleW
GetCurrentThread
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
OutputDebugStringW
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetStdHandle
SetConsoleCtrlHandler
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetEndOfFile
ReadConsoleW
SetCurrentDirectoryW
GetCurrentDirectoryW
DeleteFileW
GetFileAttributesExW
MoveFileExW
RemoveDirectoryW
CreateDirectoryW
GetTempPathW
GetModuleHandleA
LoadLibraryW
GlobalAlloc
GlobalReAlloc
GlobalLock
GlobalHandle
GlobalUnlock
LocalAlloc
LocalReAlloc
LoadResource
LockResource
SizeofResource
FindResourceW
GlobalSize
SetEvent
CreateEventA
SetThreadPriority
SuspendThread
ResumeThread
CompareStringA
lstrcmpA
user32
GetScrollPos
ShowScrollBar
SetPropA
GetPropA
RemovePropA
AdjustWindowRectEx
MapWindowPoints
CopyRect
EqualRect
PtInRect
GetClassLongA
GetWindow
LoadIconW
GetScrollInfo
WinHelpA
MonitorFromWindow
GetMonitorInfoA
SetDlgItemInt
GetDlgItemInt
GetDlgItemTextA
CheckDlgButton
CheckRadioButton
IsDlgButtonChecked
SendDlgItemMessageA
ScrollWindowEx
IsDialogMessageA
CharUpperA
RealChildWindowFromPoint
DrawTextA
DrawTextExA
GrayStringA
TabbedTextOutA
GetMenuItemInfoA
InflateRect
CopyImage
SetRectEmpty
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
MapDialogRect
IntersectRect
LoadImageW
ShowOwnedPopups
DeleteMenu
SetTimer
KillTimer
GetNextDlgGroupItem
SetCapture
DrawFocusRect
IsRectEmpty
DrawIconEx
GetIconInfo
EnableScrollBar
HideCaret
LoadCursorW
NotifyWinEvent
GetMenuDefaultItem
MapVirtualKeyA
GetKeyNameTextA
SetLayeredWindowAttributes
EnumDisplayMonitors
SetWindowRgn
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateA
DrawEdge
DrawFrameControl
LoadMenuW
GetSystemMenu
SetCursorPos
CopyIcon
FrameRect
UpdateLayeredWindow
MonitorFromPoint
TranslateAcceleratorA
LoadMenuA
InsertMenuItemA
GetMenuBarInfo
UnpackDDElParam
ReuseDDElParam
PostThreadMessageA
WaitMessage
GetKeyboardLayout
IsCharLowerA
MapVirtualKeyExA
GetKeyboardState
ToAsciiEx
LoadAcceleratorsW
ScrollWindow
DestroyAcceleratorTable
CopyAcceleratorTableA
SetRect
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuA
RegisterClipboardFormatA
CharUpperBuffA
IsClipboardFormatAvailable
EnumChildWindows
DefFrameProcA
DefMDIChildProcA
TranslateMDISysAccel
SubtractRect
SendNotifyMessageA
MonitorFromRect
WindowFromDC
GetWindowRgn
DestroyCursor
GetDCEx
GetTabbedTextExtentA
GetTabbedTextExtentW
GetCursor
LoadAcceleratorsA
GetSysColor
GetDesktopWindow
GetScrollRange
SetFocus
SetScrollRange
SetScrollPos
InvertRect
ValidateRgn
ScreenToClient
MessageBeep
WindowFromPoint
DrawIcon
GetAsyncKeyState
OffsetRect
DestroyIcon
ClientToScreen
GetWindowTextA
IsChild
SetMenu
FlashWindow
GetWindowDC
SystemParametersInfoA
GetSysColorBrush
ChildWindowFromPoint
ReleaseDC
BeginPaint
EndPaint
InvalidateRgn
EnableWindow
GetSystemMetrics
wsprintfA
wvsprintfA
DestroyWindow
RegisterClassA
CreateWindowExA
UnregisterClassA
InvalidateRect
GetFocus
SetParent
TranslateMessage
GetDC
SetWindowTextA
GetKeyState
SetActiveWindow
IsWindowVisible
GetClassNameA
TrackMouseEvent
GetTopWindow
MoveWindow
IsZoomed
GetParent
ReleaseCapture
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
CheckMenuItem
GetMenuStringA
GetActiveWindow
PostMessageA
SetDlgItemTextA
CreatePopupMenu
TrackPopupMenu
DestroyMenu
AppendMenuA
GetCursorPos
DispatchMessageA
SetWindowPos
ReplyMessage
InSendMessage
GetForegroundWindow
DefWindowProcA
GetClientRect
PeekMessageA
UpdateWindow
SetWindowLongA
CallWindowProcA
GetWindowLongA
SendMessageA
GetLastActivePopup
GetWindowRect
LoadCursorA
ShowWindow
IsWindow
MessageBoxA
BringWindowToTop
DisableProcessWindowsGhosting
SetCursor
FindWindowA
SetForegroundWindow
IsIconic
TrackPopupMenuEx
GetMenu
GetDlgCtrlID
GetDlgItem
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsMenu
GetClassInfoExA
GetClassInfoA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
LoadBitmapW
SetMenuItemInfoA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetWindowTextLengthA
ValidateRect
RemoveMenu
InsertMenuA
GetWindowThreadProcessId
IsWindowEnabled
PostQuitMessage
LoadImageA
GetMessageA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
GetComboBoxInfo
CreateMenu
EnableMenuItem
DrawMenuBar
LoadIconA
GetUpdateRect
GetDialogBaseUnits
UnionRect
FillRect
RedrawWindow
SetClassLongA
GetCapture
SetScrollInfo
CreateAcceleratorTableA
gdi32
GetPolyFillMode
GetBkMode
GetROP2
GetStretchBltMode
AbortDoc
DeleteMetaFile
CreateMetaFileA
CloseMetaFile
GetTextAlign
GetTextExtentPointA
GetTextExtentPoint32W
GetTextFaceA
SetAbortProc
CreateFontA
GetNearestColor
ExtTextOutA
SetPixel
FloodFill
GetPixel
CreateRectRgn
SetBkMode
LineTo
CreatePen
Rectangle
SelectClipRgn
MoveToEx
Ellipse
SetROP2
SetTextAlign
CreateCompatibleBitmap
StartPage
StretchBlt
StartDocA
EndDoc
EndPage
BitBlt
CreateCompatibleDC
DeleteDC
GetObjectA
SetTextColor
GetTextColor
SetBkColor
CreateSolidBrush
GetStockObject
SelectObject
GetTextExtentPoint32A
GetDeviceCaps
CreateFontIndirectA
DeleteObject
CopyMetaFileA
CreateDCA
CreateBitmap
CreateDIBPatternBrushPt
CreateHatchBrush
CreatePatternBrush
Escape
ExcludeClipRect
GetClipBox
GetClipRgn
GetCurrentPositionEx
GetObjectType
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
OffsetClipRgn
PlayMetaFile
PtVisible
RectVisible
RestoreDC
SaveDC
ExtSelectClipRgn
SelectPalette
SetMapperFlags
SetGraphicsMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetStretchBltMode
SetTextCharacterExtra
SetTextJustification
PlayMetaFileRecord
EnumMetaFile
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
ExtCreatePen
TextOutA
PolyBezierTo
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
SetPaletteEntries
ExtFloodFill
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
RoundRect
StretchDIBits
GetCharWidthA
GetCurrentObject
OffsetRgn
GetRgnBox
LPtoDP
CreateRoundRectRgn
Polyline
Polygon
CreatePolygonRgn
CreateEllipticRgn
SetDIBColorTable
CreateDIBSection
GetDIBits
GetTextCharsetInfo
EnumFontFamiliesA
CreateDIBitmap
GetBkColor
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
EnumFontFamiliesExA
GetTextMetricsA
DPtoLP
SetRectRgn
PatBlt
GetMapMode
CreateRectRgnIndirect
CombineRgn
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
PolylineTo
comdlg32
ChooseColorA
ChooseFontA
GetSaveFileNameA
PrintDlgA
GetOpenFileNameA
advapi32
RegCreateKeyExA
RegEnumKeyA
RegQueryValueA
RegDeleteValueA
GetUserNameA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueA
GetFileSecurityA
SetFileSecurityA
RegEnumValueA
RegSetValueExA
RegOpenKeyExW
RegEnumKeyExA
RegDeleteKeyA
shell32
SHGetFileInfoA
SHAddToRecentDocs
SHGetSpecialFolderLocation
SHGetDesktopFolder
DragFinish
SHAppBarMessage
ShellExecuteExA
ShellExecuteA
SHGetMalloc
SHBrowseForFolderA
SHGetPathFromIDListA
ExtractIconA
DragQueryFileA
ole32
CreateILockBytesOnHGlobal
CreateFileMoniker
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleRegGetMiscStatus
OleRegEnumVerbs
StgCreateDocfileOnILockBytes
WriteClassStm
GetHGlobalFromILockBytes
CreateGenericComposite
CreateItemMoniker
OleCreate
OleCreateFromData
OleCreateLinkFromData
OleCreateStaticFromData
OleCreateLinkToFile
OleCreateFromFile
OleLoad
OleSave
OleSaveToStream
OleSetContainedObject
OleGetIconOfClass
StgOpenStorageOnILockBytes
CreateDataAdviseHolder
CreateOleAdviseHolder
GetRunningObjectTable
OleIsRunning
CoGetMalloc
OleQueryLinkFromData
OleQueryCreateFromData
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
CreateBindCtx
CoRegisterClassObject
CoRevokeClassObject
CoRegisterMessageFilter
CLSIDFromProgID
StgOpenStorage
StringFromCLSID
StgIsStorageFile
StgCreateDocfile
OleLockRunning
OleSetMenuDescriptor
PropVariantCopy
RevokeDragDrop
CoGetClassObject
RegisterDragDrop
CoTreatAsClass
WriteClassStg
ReadClassStg
CoTaskMemFree
CoLockObjectExternal
CoInitialize
CoInitializeEx
CoUninitialize
CoTaskMemAlloc
OleGetClipboard
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
CreateStreamOnHGlobal
CoCreateGuid
CLSIDFromString
CoCreateInstance
CoDisconnectObject
StringFromGUID2
SetConvertStg
OleRegGetUserType
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
OleRun
WriteFmtUserTypeStg
oleaut32
SysAllocStringLen
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayCreate
SafeArrayPutElement
VariantInit
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
RegisterTypeLi
SafeArrayGetElemsize
SafeArrayCopy
SafeArrayPtrOfIndex
VariantClear
VariantCopy
SafeArrayGetDim
SafeArrayGetUBound
LoadRegTypeLi
LoadTypeLi
SysAllocStringByteLen
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SysStringLen
SysStringByteLen
SysFreeString
SafeArrayRedim
SysAllocString
VarDecFromStr
VarBstrFromDec
VarBstrFromDate
VarBstrFromCy
VarCyFromStr
VarDateFromStr
VariantChangeType
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
comctl32
InitCommonControlsEx
ord17
msimg32
TransparentBlt
AlphaBlend
winspool.drv
DocumentPropertiesA
ClosePrinter
GetJobA
OpenPrinterA
shlwapi
PathFindExtensionA
PathStripToRootA
PathIsUNCA
PathFindFileNameA
PathRemoveFileSpecW
PathRemoveExtensionA
StrFormatKBSizeA
uxtheme
IsThemeBackgroundPartiallyTransparent
IsAppThemed
GetThemeSysColor
GetCurrentThemeName
GetWindowTheme
DrawThemeText
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetThemePartSize
oledlg
ord8
oleacc
CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject
gdiplus
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdiplusShutdown
GdipAlloc
imm32
ImmGetContext
ImmReleaseContext
ImmGetOpenStatus
winmm
PlaySoundA
Sections
.text Size: 10.2MB - Virtual size: 10.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 900KB - Virtual size: 900KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 321KB - Virtual size: 742KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ