Static task
static1
Behavioral task
behavioral1
Sample
2024-01-26_20cf131533c633418a895b51fa1f8a9a_icedid.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-26_20cf131533c633418a895b51fa1f8a9a_icedid.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-26_20cf131533c633418a895b51fa1f8a9a_icedid
-
Size
2.9MB
-
MD5
20cf131533c633418a895b51fa1f8a9a
-
SHA1
8de1f1f954260a41c4f6f907c6daaed6489b9e3a
-
SHA256
de3383cfa2eacbeb898409f1958e97f888d260a1135100fef47930fe863cbba5
-
SHA512
08dda95f5bce44ac658d81ea365a48d36931bb9a06568de04862562d11a2de39b262417ed15aa87d2f5add59d0379e81e05ecc809ae7aabbaad7c414df7d2680
-
SSDEEP
49152:pJr6FmsnuBxexchGXTcvq4W30x83jLbvljE++2YoM:36FmsnuB4cpvo30xKbvljE+e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-26_20cf131533c633418a895b51fa1f8a9a_icedid
Files
-
2024-01-26_20cf131533c633418a895b51fa1f8a9a_icedid.exe windows:4 windows x86 arch:x86
eb3460a7739f2cecd67aca362a1e7158
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
PlaySoundA
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
rpcrt4
UuidCreate
RpcStringFreeA
UuidFromStringA
UuidToStringA
powrprof
WritePwrScheme
GetActivePwrScheme
GetPwrCapabilities
SetSuspendState
CallNtPowerInformation
GetCurrentPowerPolicies
iphlpapi
GetAdaptersInfo
SendARP
netapi32
NetWkstaGetInfo
NetApiBufferFree
mpr
WNetCancelConnectionA
WNetAddConnection2A
snmpapi
SnmpUtilMemAlloc
SnmpUtilVarBindListFree
mgmtapi
SnmpMgrStrToOid
SnmpMgrClose
SnmpMgrOpen
SnmpMgrRequest
kernel32
SetLastError
lstrcpynA
GetLocaleInfoA
GetNumberFormatA
GetCurrencyFormatA
GetDateFormatA
GetTimeFormatA
InterlockedIncrement
CreateMutexA
GetComputerNameA
GetPrivateProfileStringA
WritePrivateProfileStringA
SetEnvironmentVariableA
SetCurrentDirectoryA
MoveFileA
SetEndOfFile
GetDriveTypeA
WriteFile
SetFilePointer
GetShortPathNameA
SetCurrentDirectoryW
DuplicateHandle
DeleteFileA
RemoveDirectoryA
SearchPathA
FindFirstFileA
DeviceIoControl
CopyFileA
SetVolumeLabelA
SetFileAttributesA
MoveFileExA
UnlockFile
LockFile
CreateFileA
CloseHandle
GetFileInformationByHandle
GetFileSize
FindNextFileA
CreateDirectoryA
GetTempFileNameA
GetDiskFreeSpaceA
GetFileAttributesA
GetFullPathNameA
FlushFileBuffers
ReadFile
FindClose
GetFileType
GetThreadLocale
GlobalUnlock
MulDiv
SetConsoleCtrlHandler
GetFileTime
SetFileTime
GlobalGetAtomNameA
GlobalDeleteAtom
UnmapViewOfFile
CreateEventA
CreateFileMappingA
MapViewOfFile
GetCurrentDirectoryA
SetErrorMode
GetLocalTime
GetSystemTime
FileTimeToSystemTime
GetLocaleInfoW
TerminateThread
QueryPerformanceFrequency
QueryPerformanceCounter
GetTimeZoneInformation
EnumResourceLanguagesA
GetACP
OpenProcess
lstrcpyA
GetLogicalDriveStringsA
GlobalMemoryStatus
GetSystemDefaultLangID
SetThreadExecutionState
ExpandEnvironmentStringsA
TlsAlloc
GlobalHandle
TlsSetValue
TlsFree
IsBadReadPtr
TlsGetValue
GlobalSize
lstrcatA
lstrcmpA
IsDBCSLeadByte
IsBadStringPtrA
VirtualUnlock
FreeResource
VirtualFree
VirtualLock
VirtualAlloc
lstrcmpW
GlobalFindAtomA
LocalReAlloc
ConvertDefaultLocale
SuspendThread
GetModuleFileNameW
GlobalAlloc
GlobalFlags
GetCPInfo
GetOEMCP
CreateFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
VirtualQuery
HeapSize
ExitThread
CreateThread
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
RtlUnwind
RaiseException
ExitProcess
SetStdHandle
IsValidCodePage
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
GetStdHandle
GetConsoleCP
GetConsoleMode
SetHandleCount
FreeEnvironmentStringsA
GetEnvironmentStrings
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GlobalLock
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
FileTimeToDosDateTime
CompareFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
DosDateTimeToFileTime
SystemTimeToFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetUserDefaultLangID
GetVolumeInformationA
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentThread
GetModuleHandleA
CreateProcessA
GetSystemInfo
SetPriorityClass
GetPriorityClass
ResetEvent
SetEvent
TerminateProcess
GetExitCodeProcess
WaitForMultipleObjects
GetTickCount
ProcessIdToSessionId
GetCurrentProcessId
GetCurrentThreadId
InterlockedExchange
GetVersion
lstrcmpiA
CompareStringA
CompareStringW
GetEnvironmentVariableA
InterlockedCompareExchange
GetExitCodeThread
SetThreadPriority
ResumeThread
FindResourceExA
LocalAlloc
FormatMessageA
ReleaseMutex
WaitForSingleObject
OpenMutexA
Sleep
GetModuleFileNameA
GlobalAddAtomA
GetCurrentProcess
lstrlenW
InitializeCriticalSection
lstrlenA
FreeLibrary
GetProcAddress
LoadLibraryA
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
LocalFree
GetLastError
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
GlobalReAlloc
VirtualProtect
GlobalFree
GetVersionExA
gdi32
EnumFontFamiliesExA
GetMapMode
CreateCompatibleBitmap
ScaleWindowExtEx
SetWindowExtEx
SelectPalette
CreateBitmap
CreatePatternBrush
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
RectVisible
PtVisible
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
SelectClipRgn
ExcludeClipRect
GetClipBox
SetTextColor
SetStretchBltMode
RestoreDC
SaveDC
GetBkColor
SetBkColor
SetBkMode
CreateSolidBrush
CreateDIBSection
CreateCompatibleDC
GetPaletteEntries
StretchDIBits
SetDIBitsToDevice
UnrealizeObject
CreateHalftonePalette
GetTextExtentPoint32A
SetMapMode
GetTextExtentExPointA
TextOutA
DeleteDC
EndDoc
EndPage
StartPage
StartDocA
SelectObject
DeleteObject
GetTextMetricsA
CreateRectRgnIndirect
CreatePalette
RealizePalette
GetBitmapBits
GetDeviceCaps
CreateFontIndirectA
GetObjectA
GetStockObject
comdlg32
GetFileTitleA
PrintDlgA
GetSaveFileNameA
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
shell32
DragQueryFileA
Shell_NotifyIconA
SHGetFileInfoA
SHGetFolderPathA
DragFinish
SHBrowseForFolderA
ShellExecuteA
SHGetPathFromIDListA
SHGetMalloc
SHGetDesktopFolder
SHGetSpecialFolderLocation
ole32
CoTaskMemFree
OleRun
CoSetProxyBlanket
RevokeDragDrop
RegisterDragDrop
CoUninitialize
CoInitialize
CoInitializeEx
OleUninitialize
OleInitialize
StringFromGUID2
CoCreateInstance
CLSIDFromProgID
DoDragDrop
wsock32
getservbyname
getservbyport
WSAStartup
ioctlsocket
inet_addr
gethostbyname
WSASetLastError
ntohl
inet_ntoa
setsockopt
recvfrom
sendto
send
select
recv
WSACleanup
shutdown
listen
htonl
bind
closesocket
connect
socket
getsockopt
gethostbyaddr
accept
htons
ntohs
getsockname
WSAGetLastError
gethostname
msi
ord141
ord176
ord5
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 444KB - Virtual size: 441KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 80KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 800KB - Virtual size: 796KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.SEFCMD Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ