Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27-01-2024 04:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-27_9da7d3a84726522322d18ea3e542685e_icedid.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-27_9da7d3a84726522322d18ea3e542685e_icedid.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-27_9da7d3a84726522322d18ea3e542685e_icedid.exe
-
Size
13.2MB
-
MD5
9da7d3a84726522322d18ea3e542685e
-
SHA1
9da9f1d41dd706c0ed4551b92c5f9ab765241109
-
SHA256
f6672d277b7a57e012141c2671db76f59e4e43d5aec031e778e8b67e5df26c2e
-
SHA512
2c81f54ec22e52c40219c813176537bd53164246f722fc3a5f2b9aba47340c85ae8632ca9daacdf5309cef091f9c69d825682076c3465d4b7d3254ca4236678c
-
SSDEEP
393216:Y4yoTw5+HAINmo27QG8g1bgsSFd+RHhdTJG36:+oTw5iNmn8jFd+p7gq
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3508 autorun.exe -
Loads dropped DLL 1 IoCs
pid Process 3508 autorun.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3508 autorun.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2612 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2612 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3508 autorun.exe 3508 autorun.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3508 autorun.exe 3508 autorun.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4572 2024-01-27_9da7d3a84726522322d18ea3e542685e_icedid.exe 3508 autorun.exe 3508 autorun.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4572 wrote to memory of 3508 4572 2024-01-27_9da7d3a84726522322d18ea3e542685e_icedid.exe 88 PID 4572 wrote to memory of 3508 4572 2024-01-27_9da7d3a84726522322d18ea3e542685e_icedid.exe 88 PID 4572 wrote to memory of 3508 4572 2024-01-27_9da7d3a84726522322d18ea3e542685e_icedid.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_9da7d3a84726522322d18ea3e542685e_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_9da7d3a84726522322d18ea3e542685e_icedid.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\autorun.exe"C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\autorun.exe" "SFXSOURCE:C:\Users\Admin\AppData\Local\Temp\2024-01-27_9da7d3a84726522322d18ea3e542685e_icedid.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3508
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x150 0x5041⤵
- Suspicious use of AdjustPrivilegeToken
PID:2612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5967fdfe0a01c083804673b4976ad6730
SHA15d05ade6dd0d1d67ea7879cd8f7779ef53abbd4c
SHA25672eda9d49bcd0cd3b540f75c4215714378afbb1ce40afcbb7a0b246ab2a44f21
SHA51250acacf15fa4cfa8319f789fb534cdb4a8d559ceb3e5e832b32015ff2fbee2c3902abfc83bc2493d57298ed32d0aeb6817e077758c4c2c956432b1d3f3c738d4
-
Filesize
76KB
MD522a71f629c98175d22e5b58ab5e98238
SHA12c8a8ebbdd3a09e12a6f74fc8242d5285d8be94d
SHA2569d800eb65e5ff3a1e8110de24e35483100369c8028fc7f13adcaec6cb3d77a03
SHA512ec98a99c63e7fb51babcf7e98e1a5f4a0421170d605a434fd2fa855e6c3ce0bf1b51615b48ece12bfd2d5e710d06cafb4f7c82399a3009c2dafaf298f4e8dfef
-
Filesize
3KB
MD5c67c096e11c2a585402526978c8a2b37
SHA11be37c1b46dbe457c6a6f4167cd0c7bd2aa48dc5
SHA256659fb51b3bf9c86e760227dae95fa6c396e4dd4e3a86d0baa47e58bdfefb2c39
SHA512823a4aef85aba863a42d73e3136bf8f46b69da782d2ea70fc8c6e82420148cfb5745f6d1c4e0c861162f96606cdd6883b8fc10961bdbf33616446d9e5cb207cd
-
Filesize
1KB
MD5f539b2204d0ba0e1260531bc3355ea4c
SHA1cd6461d46c6b4d55762a8314b265c11500d48cda
SHA256d46ac2babe5e302286765b4044efecca4459389fd73f212dae61d4baa8f50e07
SHA512b99c22b71d17c3fd02c66c917d81ccdc9547bd669dfe946cc9570118e5ea21c24dd8b35530f0885412c19f3cbe06c4ed5eb2a64013ca2aea9a2ef5c429457113
-
Filesize
15KB
MD5b858a0ffec90d421b652984c07dc8b29
SHA1870ade1204e06ac719e1746f13635fe6fb6e53d8
SHA2564185e9b28906ecde544f36d6bab3a62eca7394e8c13d61f8d7236d6998b74baa
SHA5124f439b080d35236afb0c89f1992ed9ad27f36e86cb6a7726ccdca92b35f78ce0ea47e60c4265b629075f08582763480bd8e04ede3a4a62ac3eeaaf2c5cb6d67a
-
Filesize
17KB
MD5beae485bc4f34be1fb977a07b62fdb67
SHA14a6a5c07521a04415d1223975119bf559547460d
SHA25660c044b725b7ecebddf215a2a1a81769eb117ba1f162f86e4818447df97318c1
SHA51266d8d6ea8c51d31adbeb7a547a32c3e731c951fbc89db36ef174b72586c21eb13ac4aca771d4bfae04af539e0cef3049fba00ad9563d4b0140afe5ed09b25029
-
Filesize
2KB
MD5a6a7394b47484d52d7fede693ea5e10e
SHA1e09ac022db5724317f659148eb0fd22701aa4528
SHA2569c1e07587c39d4ae6e5dde399c928829328da73f24e8e904918fcbc6806d9686
SHA512ae56e6d0313e9f446ff1f3b459ddd6ec893cc161082be73ad527c471152f3f4fe53c755faa7ce6961dee524adee394aef09cd9452f2bd63aa5ebc699a55d944b
-
Filesize
21KB
MD5c5f9a269e1444d6d0353589d00390c75
SHA11a43aeca1ffb93365750f9d954a9c19bcab387b1
SHA256e82a9ada6d3b0681e6f25bd6333ff5b7e4f1561e264ad2bdcadfad5dfb83127a
SHA5120cc24b4012859bac4dc96f42d960b0f5bb03dfc2ddb2738f70b479616c835b656ce4acbd012d5d68d188fdb1b9f0f082c22a1b0b41400f826e2b758a24ce9ce8
-
Filesize
5KB
MD52a49900adc291ca27800b8def4509a3b
SHA1164c34de5ff863f2524764259e15202f1599e1e6
SHA256b87927cad3f3b475a22cc2ac2ef2544782fd4f119c4b441d688462c31e8e3f25
SHA51209d5d4d56bccd33136601b8af8014ecaf358a2d0e0be24f5c4845d5ea599c06f96debb17bd4cfd503cdeae639c405d1d8989e4c1680788d6a176412549a025c7
-
Filesize
174KB
MD5ae909d02341a615ce73f8ce24270016f
SHA185509f31c93f2e878ecaabb257f26e7e9c8bae36
SHA2563fe0a13da97adbea948935bd80eca44e20e4c2f35d5b97f3f2bed7e1c532fb09
SHA5124de3e16e78cfc2abf5872eca179c3399b920ee2d6c7b5ab0a1d10bcb62f220250f0ed53dd6eb3e1fdc3ccf848976080190dbabdd37757ad48e01ab9daaf2b7dc
-
Filesize
11KB
MD581b8e13005e3251f16a4a5a8dd413a5e
SHA15ed0220880b4b9d580b6f976a2eb85f8f1a43341
SHA2562ad099d788cc111cc66cde72f6cbeb083909950aec3108305abc71d3ed63ade2
SHA512f76170ea225203d953e76f37c3156e764078b10c3bca2e81c30a7457c09d53f4088d05a3484961e99a40222daad6208f2ac54ba74ad7b61f295cc3dea58cb62c
-
Filesize
29KB
MD560276137b1526b528a359da97ceb50a7
SHA15f16b189ce77031f2199e6b6a719789197ea212d
SHA2561700568efa87005b3c913fda077add968a50bc9ba82572d73e28ffd293c50e0e
SHA51216c655b2634d4f65bb62905b571d9340d3a36007a5567b19531aa9039f52c76b94fc508c9d0aeb2c929b0a28c5ec9b399c1d26fec28b4a4681b0ab54c4509002
-
Filesize
15KB
MD5b273896715ca2aa98506dbc0cf81e260
SHA1d0cf383008fe1bfb218a15136369c66115461dcc
SHA2568e7a3d6a050d179d8a72c77fad325e5fd778555341b88287813d866b4d78e6f7
SHA512aee9f64f53b169ebdb2bf261dfcff68fe59de1fe238e54e6f31047fa8eeddf886ccd4cd2430b4827b8ef492ab1a326492a94760f4c50e02d85f2838f34d6d896
-
Filesize
39KB
MD59f25b99ef4d357a69a35ed202457bbd1
SHA148923fd09948f982e4d9171b272b2936a32989d0
SHA2569cc4a9e620617b074512bddcd60df13ce36b4b51d7bd556c7a0e635a3ccd19a3
SHA512ab7d9ef7f7446087d34962b662891b3e26965f304b631e46d89c4502c4e369eafd782cac45f9516c609ea4c41eb599a38827016cb36aee46295b9e5ebb5ff752
-
Filesize
251B
MD520a69c9ed6526c7c98fdfe7be1eb752b
SHA11a961df7fc28c965f82a7bf113d74672df658b82
SHA256fce80364b88f9b9255133782f8d73e551effea8004a4650bf70be746ee3ac796
SHA51223ac65b59c5f752ec4f03f60b3b2d3fcc975105a220039b8eccf632e67863b899d1679be1e295b2919c5fbf68db728c235aacaa3bfaa98512f1aac179ed07a3a
-
Filesize
1022B
MD5bbfccaf0c4baa5b1445937f9bc3cc2f2
SHA11212e65edff3d2da4555ae339414473e6de0c82a
SHA256b370bbf11ffaab2add1f31ab71d898df9f804690700e5e370fae69e38a64bd23
SHA5121a5ec1324eb543acbd71b0292110908596e71b78bac8bee19c9e42de470d8a458be553e23a1b55d615578613059eabf0e650e64c5f40841fae7ac8fabfd0c359
-
Filesize
48KB
MD55d24f3cfad3fa5023c67822c14c4f8e9
SHA1b257634e1e7940e3167fedf0d47c73da330517ba
SHA256fe2bab7b79c2cca26e60d3cf4290b6f5e92811c535f0c0c2bb49c5b3d632d641
SHA51293a4fb1d8f5c1bcb4e504f855a4b9d2682f36d6367470d710f64e3d6735a76a0329bfe511d92d88024a6ab88363fb47fd87713f4c3348d1f7564c9258aed14f5
-
Filesize
12KB
MD576ed6918ef8fa4d58d9bb429427cea8a
SHA19a9038b0a801bc986668b66aa143ca5432aa9ba8
SHA256992e5657d64fa7c702d23df7f194c5908aaa565b146e6df82123e46de025f460
SHA512fa2efafa9ac32e5e50b1c7ca64004189126cc4b2b0aab94248ae29431ed36ff0b799332297ed386eb415a79fb24c1517062b55a670488a70017f267b1e052101
-
Filesize
16KB
MD501163c7f9f529483c9f4f4caeecccb76
SHA1b98fd388c20755c3a7417e74f31d284748b4beb9
SHA256bae6b4980bb5fb19fb3d94123bd0f9cea4d4c0eb670174e1d0f7ef4ac56231b9
SHA512aea7ab547b753636d79783f6059b35b255defe7684ba39817eee9e235cd93eed334d58d7b01a3c66eef8360abf8b87466a71fd0c889fcd9f5b0f778c03a6a756
-
Filesize
16KB
MD5ead26785697d156ed12c50b463e2cdde
SHA13672cf9e91bc812630c4f978fdc9b70d481c94f3
SHA256be40889222dadb98b56abca24f042241fd913c69db3a5d2f3a3067c315b872ce
SHA512b1d5333413f7519cbbb094677deebbbb8d9b7948a575d58d2a963e2562a4c46f498b8bf977ff3c4638e1d6a3f29abc886a4d9137cac8d499ba1e10d96608e557
-
Filesize
17KB
MD5518deebb44d394be479744521e30fe01
SHA1214f76ae8663d7ce86b64a4061128ba87b09b3f4
SHA256cae0a3a65a86457b663faaa0764dbc455e0b5e6ba28a56fceffff81a250eeeda
SHA5121a9783dfe70fb2fc2e0c8c77fcbfcaca7868d92d9c221523d3590b88e0766e89f085479bc311d1eafeaf784c2b0db4ae546da492fabec40daa6458445b0503df
-
Filesize
31KB
MD53918b04b1d293afad777c48fc022ec4c
SHA1da8b690bd294f94638df30890c787923e8c1a94d
SHA256acdb3a40a06404f99e9267ca539e89fb3ece50a77d569eed354bd9358776c7d8
SHA512d4fabc45b5834ba21c8a39cb6fe9a6e65a1a3627a1a6edb77ddd0c24307ad4b6a37b5a7eebcc930ce29c94efa1d06a6fa8cd53e3717cc3bcbbe58421fdb2c88d
-
Filesize
226B
MD5226587fef106ab807305e8928b0d9d77
SHA19a21b24397b5f21deb4debf2676b5b414cca684b
SHA25681c2f972ddeb20ee624d610fa03735ea49db4a74bd4dea4e15a75407ffd228e9
SHA512579bc4f207e8c3749e7ec16945194651ed044ace320cdb1747528213fe75c9cb29a8c2aed452b4f5a90472b68df3be4b9e83f2505f5cfc1ede4b5e35c68fe9dc
-
Filesize
37KB
MD500f81be16d3c7dc7224a528e3229f0ce
SHA1ceb6f716ad15e33958282db2085108dfe9894d26
SHA256f299ee609af7103cc79277bbd8e109ec6e8ad56679308a7f6ed50a27a219e5aa
SHA512e8e3a3686a22800bb304f3a358e3045cbfc6698e659fc4449b6bcc74ec3dcf3f3622585ad36fb5e9b1027d7e6d93e857dae8e0df9be783b6aa38393e03faeed6
-
Filesize
5KB
MD5967f37e939b4c633425b64f4416ae9cd
SHA1727238e9bbb7ceb3ce00117da4114970b7981c58
SHA25605e4f4458547f8295575fc73799caea197bc7f1481f2eb16d3a9758d3d03a275
SHA5128ccf9240ba2e2c60a35f71c3b7cb9c6a0f302148338f2e502203ff39ecd90366545e0035591cd2f8d2dc9b3c2eb2129307de1f32ccc7460ebf8159351614f2ad
-
Filesize
7KB
MD529c423eb57a46027a93677a5d9f53387
SHA126a9afc73705ead5363270bf9a2905aa64eda291
SHA256d2e4f8fcd6bb452fe27eb584a1643f28254b4d92637935b04e73372116ed112f
SHA51289065ee0dc5702b88a531ea0f2c04d50ddf66a51b122aa4dd7c91bcedfcef4072ca65f1342d5410814b8e92d7f383329113ed532ad7e4c61fd21738b0719e709
-
Filesize
8KB
MD566a5527abb92842b0dd5bfffe6a5ccca
SHA105b5bf42364aab70c2642e35e8299459b3583463
SHA256c2a1a8148dbc6bc28d962b4c14548cfc6303bd392bcc25affc88f8e3285b6c53
SHA51289870396b0ea3ff356e2ca38b252f100b885ff9f5cf9fc27fd60f135e089b29ae08fcf997ff77f2670a6355a9c599e028a185e4cadd9e0f982f07351236edd3e
-
Filesize
44KB
MD516113f86b25c393c4ad410e3049e883b
SHA1913bbe7bf85892201c0b5655c756f7c69d032c55
SHA25674440321dae20514226c84de07bfd46b12094c7a8c69f1be9656b8429b9055ce
SHA512d019addfea21f25a11123dd8c72ce908c07623c6ec1e3d148f4be9a946a25209881c8e9f31939183f20b14afece2478b377388cae6abce62089f884d2bb6d117
-
Filesize
1.2MB
MD53f801c7a17ae28b9befa2d3bea7382fe
SHA1019efe578cd10322e2544b812a6e74c663ec5245
SHA256bb98ce6760d741a45a1311e112873e538881cc8f97e1bfe1ee4499fe6f2690dd
SHA512eeb4657712c860256877e06212d139a0bc7cfb5dbe631cf7837b43d692fbf3e3f49a779076f4efb2a9e6df1e753443389f91ab33e94cbd008f7689e18cfead9a
-
Filesize
1.1MB
MD5f3121162d680b721abfd9156ad8b5573
SHA15113c3e64dae8669e31988c7c7c95cc38bb63021
SHA2569003086df49c127a637dc42f5b10836ba5bd7ac070a89df49a1da222890252a1
SHA512427a8566e6702acb84a5281f9285ed3f903117cfd4d20b5cd83037040db5ce3f11bec6e9cd3594280b4f12ef9b81dd0edd58a88651c82970c162e48256383529
-
Filesize
1.2MB
MD506baaee5b534b3f8f3fa1df583824ae6
SHA162da889a13839d422d19b5ac74fe6a72757f0267
SHA2569a35e3bf2929f1ce1977e607872fde70e2d6a50a9ed73f1e5f2acf13ef3c611a
SHA51245a51b57e73b4863f03afcfd23690858685db2063ccc343d849999f368f52e734fd2f0076c693b940be32027677052b883f451645323ef71c96dee0d43fbb333
-
Filesize
68KB
MD50dec77c500de67e8cd76dd6852a5dd35
SHA1f20cc663609704df19ac9e6f473d44d39c8997f6
SHA2568afc2a48773779d3206bfe4308bc14b52faab9ae08b103bfbb29a1e75d8bb1bc
SHA512dd09b91c9289fc57a14af93c7f19080ec014eb91f61fc25c5ef671713dfefba58f2de8be045ccd424e8394abccbe94d8884ac7b522b6fe854bd2b48544c45ab3
-
Filesize
318KB
MD56ba309b082299fd3e3e4ce68323438aa
SHA1679f9abdcb03db3ebd77c2c4fdfd138cca4e3a43
SHA256cd19f435dc980ef59ce5719a11705a81fd2f236f3a10a73de2502e05e6156188
SHA5125cd27b2be6b42d8b50195bde83b9bb1e45a9975dfba1f2b52c86bf126f5354f6650e80a78bb541b40f58d78f0243c8a5b52f49a9288eebf214497c393976deaf