Static task
static1
Behavioral task
behavioral1
Sample
2024-01-11_cb404f1530b5536114da4cd1600ec935_icedid.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-11_cb404f1530b5536114da4cd1600ec935_icedid.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-11_cb404f1530b5536114da4cd1600ec935_icedid
-
Size
1.6MB
-
MD5
cb404f1530b5536114da4cd1600ec935
-
SHA1
9d430045b308f2c0a9b74bfe05a347ba9fa5375c
-
SHA256
41f810f73921cb9c060e2108baf201f745faffb894d83f8c059b433c8c5ea8f0
-
SHA512
d888802e0344820d38ceaae6c3b35baca9c75302baddea0e54e29d5d50db0d632b4912c185f05df0555cb9f4954158ea243c88061ad408f55900c60b2224c064
-
SSDEEP
24576:bgLZStYfXYav8IbWs3bwW3qhetyUOMQIJklitz2pU:b6SS9Jbx3bwW36etyUOaklqqm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-11_cb404f1530b5536114da4cd1600ec935_icedid
Files
-
2024-01-11_cb404f1530b5536114da4cd1600ec935_icedid.exe windows:5 windows x86 arch:x86
60f1b86b2af72e3ec6f7f836f1c8e553
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
processflow
InitProcessFlow
CheckProcessEnable
DisconnectDB
WriteDataToFlow
ConnectDB
ExitProcessFlow
kernel32
ConvertDefaultLocale
GetCurrentThread
SetFileTime
GetTempFileNameW
GetDiskFreeSpaceW
GlobalGetAtomNameW
LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
SystemTimeToFileTime
SetErrorMode
GetFileAttributesExW
LocalFileTimeToFileTime
GetFileSizeEx
FindResourceExW
GetCurrentDirectoryW
GetStartupInfoW
GetSystemTimeAsFileTime
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
EnumResourceLanguagesW
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GetCurrentDirectoryA
GetDriveTypeA
GetProcessHeap
CreateFileA
GetLocaleInfoW
CompareStringA
InterlockedExchange
lstrcmpA
GetModuleHandleA
VirtualProtect
GetShortPathNameW
GetFullPathNameW
GetVolumeInformationW
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
lstrcmpiW
GetThreadLocale
GetStringTypeExW
MoveFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCurrentProcessId
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetVersionExW
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
GlobalAlloc
FormatMessageW
LocalFree
MulDiv
GlobalLock
GlobalUnlock
GlobalFree
FreeResource
lstrcpynW
lstrcpyW
lstrcatW
GetModuleFileNameA
IsBadReadPtr
GetFileTime
InitializeCriticalSection
DeleteCriticalSection
lstrlenW
CreateFileMappingW
MapViewOfFile
GetLocalTime
FindNextFileW
ResetEvent
LeaveCriticalSection
EnterCriticalSection
UnmapViewOfFile
WritePrivateProfileSectionW
GetPrivateProfileSectionW
FindFirstFileW
FindClose
FreeLibrary
GetModuleFileNameW
GetPrivateProfileStringW
CreateThread
Sleep
CreateEventW
SetEvent
WaitForSingleObject
SetLastError
GetProcAddress
GetModuleHandleW
LoadLibraryW
GetFileAttributesW
SetFileAttributesW
WritePrivateProfileStringW
GetTickCount
GetTempPathW
CreateDirectoryW
GetLastError
WriteFile
GetFileSize
ReadFile
CreateFileW
WideCharToMultiByte
DeleteFileW
RemoveDirectoryW
InterlockedDecrement
CloseHandle
InterlockedIncrement
GetPrivateProfileIntW
lstrlenA
FindResourceW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
HeapSize
user32
GetNextDlgGroupItem
RegisterClipboardFormatW
ClientToScreen
GrayStringW
DrawTextExW
TabbedTextOutW
WindowFromPoint
MapDialogRect
GetAsyncKeyState
CharUpperW
GetMessageW
GetCursorPos
ValidateRect
GetWindowThreadProcessId
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
EnableMenuItem
CheckMenuItem
LoadMenuW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextLengthW
GetForegroundWindow
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
TrackPopupMenu
SetMenu
InvalidateRgn
SetForegroundWindow
IsWindowVisible
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowLongW
SetWindowPos
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetMenuState
GetMenuStringW
GetMenuItemID
InsertMenuW
GetMenuItemCount
GetSubMenu
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetWindowLongW
LoadAcceleratorsW
InsertMenuItemW
CreatePopupMenu
BringWindowToTop
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
GetDesktopWindow
DrawIcon
GetMessagePos
GetSystemMetrics
ReleaseCapture
SetCapture
GetCapture
ScreenToClient
MapWindowPoints
DrawFocusRect
DrawFrameControl
OffsetRect
PtInRect
GetClassNameW
CopyAcceleratorTableW
CharNextW
DestroyIcon
DeleteMenu
UnregisterClassW
SystemParametersInfoW
GetMenuItemInfoW
GetWindow
ReleaseDC
GetDC
LoadCursorW
GetSysColorBrush
UnpackDDElParam
ReuseDDElParam
DestroyMenu
TranslateAcceleratorW
SetWindowContextHelpId
LoadImageW
FrameRect
IsRectEmpty
IsWindow
EnumWindows
GetWindowTextW
GetKeyState
MessageBeep
SetRect
keybd_event
GetCaretPos
KillTimer
SetTimer
InflateRect
UpdateWindow
GetFocus
PostThreadMessageW
FillRect
GetSysColor
IsZoomed
CopyRect
GetParent
GetClientRect
DrawTextW
LoadBitmapW
GetWindowRect
PeekMessageW
TranslateMessage
DispatchMessageW
PostMessageW
LoadIconW
SendMessageW
EnableWindow
InvalidateRect
ShowOwnedPopups
SetCursor
PostQuitMessage
SetRectEmpty
EndPaint
BeginPaint
GetWindowDC
RegisterClassW
gdi32
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
TextOutW
GetStockObject
GetBkColor
GetMapMode
DPtoLP
GetCharWidthW
StretchDIBits
EnumFontFamiliesExW
GetRgnBox
PtVisible
RectVisible
GetPixel
GetWindowExtEx
GetViewportExtEx
SetBkMode
SelectObject
SetTextColor
DeleteObject
CreateSolidBrush
GetTextColor
CreateCompatibleBitmap
BitBlt
CreateCompatibleDC
GetObjectW
CreatePatternBrush
CreateFontIndirectW
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
SetMapMode
RestoreDC
SaveDC
CreateRectRgnIndirect
CreateBitmap
SetBkColor
GetClipBox
GetDeviceCaps
CreateDIBSection
CreateFontW
ExtTextOutW
Rectangle
CreatePen
GetTextMetricsW
DeleteDC
GetTextExtentPoint32W
comdlg32
GetFileTitleW
winspool.drv
ClosePrinter
OpenPrinterW
DocumentPropertiesW
advapi32
RegEnumKeyW
RegQueryValueExW
RegCreateKeyW
GetFileSecurityW
SetFileSecurityW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueW
RegCloseKey
RegDeleteKeyW
RegOpenKeyExW
RegOpenKeyW
RegSetValueW
CryptReleaseContext
CryptAcquireContextW
shell32
ExtractIconW
SHBrowseForFolderW
SHGetMalloc
ShellExecuteW
SHGetFileInfoW
DragFinish
SHGetPathFromIDListW
DragQueryFileW
comctl32
ImageList_GetIconSize
ImageList_DrawEx
shlwapi
PathIsUNCW
PathRemoveFileSpecW
PathFindExtensionW
PathStripToRootW
PathFindFileNameW
oledlg
OleUIBusyW
ole32
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoInitializeEx
CoTaskMemAlloc
OleFlushClipboard
CoTaskMemFree
CoUninitialize
OleInitialize
OleUninitialize
CoInitialize
CoCreateInstance
OleRun
CoRegisterMessageFilter
CoRevokeClassObject
OleIsCurrentClipboard
oleaut32
VariantCopy
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
SysStringLen
SysAllocStringLen
VariantClear
VariantChangeType
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
VariantInit
GetErrorInfo
setupapi
SetupDiDestroyDeviceInfoList
SetupDiOpenDevRegKey
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
Sections
.text Size: 619KB - Virtual size: 618KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 258KB - Virtual size: 258KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 748KB - Virtual size: 748KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ