196f083c6c2bac55b9958c05a5f2aefb6635ec2431cf22a92528cc0c3cc63a57

General

Target

2024-02-01_9d35d4dab51991d53e6c4ad6d4799b00_icedid.exe
Size

272KB
MD5

9d35d4dab51991d53e6c4ad6d4799b00
SHA1

2a9650f39cca88b63379583d49656990a58faff6
SHA256

196f083c6c2bac55b9958c05a5f2aefb6635ec2431cf22a92528cc0c3cc63a57
SHA512

01b2dbba1dc6a0905c1e13cd05c5be69dd35bfaacd903d01b16bed7cd4ceb1a368343df74e73f1630250d75cba6e4d145499f77026bfcf0727bb9abf340030f8
SSDEEP

6144:vYCI+wfwpNDsbDxR8w5b0snvg6FDnsNBR:gCzwC9+X5bjg6FDn2

Score

9^/10

Malware Config

Signatures

Detects executables packed with ASPack 30 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012327-7.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1904-6-0x00000000001B0000-0x00000000001CC000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1904-9-0x00000000001B0000-0x00000000001CC000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1904-10-0x00000000001B0000-0x00000000001CC000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0034000000014fa0-13.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2316-16-0x0000000074E90000-0x0000000074EAC000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2316-15-0x0000000074E90000-0x0000000074EAC000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2712-22-0x0000000074940000-0x000000007495C000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2712-23-0x0000000074940000-0x000000007495C000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1904-25-0x00000000001B0000-0x00000000001CC000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2556-30-0x0000000074E90000-0x0000000074EAC000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2556-31-0x0000000074E90000-0x0000000074EAC000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/3044-35-0x0000000074E90000-0x0000000074EAC000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/3044-36-0x0000000074E90000-0x0000000074EAC000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2744-41-0x0000000074E90000-0x0000000074EAC000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2744-42-0x0000000074E90000-0x0000000074EAC000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2748-47-0x0000000074E90000-0x0000000074EAC000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2748-48-0x0000000074E90000-0x0000000074EAC000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2748-49-0x0000000074E90000-0x0000000074EAC000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1540-53-0x0000000074E90000-0x0000000074EAC000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1540-54-0x0000000074E90000-0x0000000074EAC000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1512-61-0x0000000075360000-0x000000007537C000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1512-62-0x0000000075360000-0x000000007537C000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1684-67-0x0000000075360000-0x000000007537C000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1684-68-0x0000000075360000-0x000000007537C000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1924-73-0x0000000075360000-0x000000007537C000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1924-74-0x0000000075360000-0x000000007537C000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2944-79-0x0000000075360000-0x000000007537C000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2404-86-0x0000000075360000-0x000000007537C000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2404-88-0x0000000075360000-0x000000007537C000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Sets DLL path for service in the registry 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	543430ad.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	543430ad.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	543430ad.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll"	543430ad.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll"	543430ad.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll"	543430ad.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	543430ad.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	543430ad.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	543430ad.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll"	543430ad.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll"	543430ad.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll"	543430ad.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	543430ad.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll"	543430ad.exe

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000c000000012327-7.dat	aspack_v212_v242
behavioral1/files/0x0034000000014fa0-13.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1904	543430ad.exe

Loads dropped DLL 12 IoCs

pid	Process
2316	svchost.exe
2712	svchost.exe
2556	svchost.exe
3044	svchost.exe
2744	svchost.exe
2748	svchost.exe
1540	svchost.exe
1512	svchost.exe
1684	svchost.exe
1924	svchost.exe
2944	svchost.exe
2404	svchost.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2080-0-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral1/memory/2080-26-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral1/memory/2080-55-0x0000000000400000-0x0000000000448000-memory.dmp	upx

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\PCAudit.dll	543430ad.exe
File opened for modification	C:\Windows\SysWOW64\helpsvc.dll	543430ad.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	543430ad.exe
File opened for modification	C:\Windows\SysWOW64\Wmi.dll	543430ad.exe
File opened for modification	C:\Windows\SysWOW64\uploadmgr.dll	543430ad.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	543430ad.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	543430ad.exe
File opened for modification	C:\Windows\SysWOW64\LogonHours.dll	543430ad.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	543430ad.exe
File opened for modification	C:\Windows\SysWOW64\WmdmPmSp.dll	543430ad.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	543430ad.exe
File opened for modification	C:\Windows\SysWOW64\SRService.dll	543430ad.exe
File opened for modification	C:\Windows\SysWOW64\Ias.dll	543430ad.exe
File opened for modification	C:\Windows\SysWOW64\Nla.dll	543430ad.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1904	543430ad.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2080	2024-02-01_9d35d4dab51991d53e6c4ad6d4799b00_icedid.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1904	2080	2024-02-01_9d35d4dab51991d53e6c4ad6d4799b00_icedid.exe	28
PID 2080 wrote to memory of 1904	2080	2024-02-01_9d35d4dab51991d53e6c4ad6d4799b00_icedid.exe	28
PID 2080 wrote to memory of 1904	2080	2024-02-01_9d35d4dab51991d53e6c4ad6d4799b00_icedid.exe	28
PID 2080 wrote to memory of 1904	2080	2024-02-01_9d35d4dab51991d53e6c4ad6d4799b00_icedid.exe	28
PID 2080 wrote to memory of 1904	2080	2024-02-01_9d35d4dab51991d53e6c4ad6d4799b00_icedid.exe	28
PID 2080 wrote to memory of 1904	2080	2024-02-01_9d35d4dab51991d53e6c4ad6d4799b00_icedid.exe	28
PID 2080 wrote to memory of 1904	2080	2024-02-01_9d35d4dab51991d53e6c4ad6d4799b00_icedid.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-01_9d35d4dab51991d53e6c4ad6d4799b00_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-01_9d35d4dab51991d53e6c4ad6d4799b00_icedid.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\543430ad.exe
  C:\543430ad.exe
  2⤵
  - Sets DLL path for service in the registry
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1904

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:2316

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:2712

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:2556

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:3044

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:2744

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:2748

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1540

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
PID:1268

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1512

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1684

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1924

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:2944

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\543430ad.exe

Filesize
56KB

MD5
93bfea9d4f44a9d95350b0aeddeeacfe

SHA1
47caa754ccf9c7c94ca31a28cf3cea829d5cac98

SHA256
c4fba03ae9ecdf195f527b2e333860dbb0a1f88b23c80e8a2eeb4e08e2512523

SHA512
f8daa5806895dc652d9e6c1cc5f0cc747e0f0e64ac512f092c0f00fbd75577677a599c5ab30e0aab6247449d312ca694e11f81578b76f5a66a8c8c72e806bac1

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
56KB

MD5
2209d44facbe870921438ca7714d5864

SHA1
5aa84344426d27a3b6c872bfa65b9dfb1d1adc63

SHA256
d290f5e214952e59613198c61bb190ce0ebbf4c20c30eb010140da417eb3d6f0

SHA512
5c5996716a46ad3bf4344ef6cc636a3515da072a8e1fba9f87a1cd7bb38a01456fc8d2b68601b7cc958d1abdb2cc982240e7c1ed5e2362952ad1c3f9bd441035

Download Submit
memory/1512-61-0x0000000075360000-0x000000007537C000-memory.dmp

Filesize
112KB

Download
memory/1512-62-0x0000000075360000-0x000000007537C000-memory.dmp

Filesize
112KB

Download
memory/1540-53-0x0000000074E90000-0x0000000074EAC000-memory.dmp

Filesize
112KB

Download
memory/1540-54-0x0000000074E90000-0x0000000074EAC000-memory.dmp

Filesize
112KB

Download
memory/1684-67-0x0000000075360000-0x000000007537C000-memory.dmp

Filesize
112KB

Download
memory/1684-68-0x0000000075360000-0x000000007537C000-memory.dmp

Filesize
112KB

Download
memory/1904-10-0x00000000001B0000-0x00000000001CC000-memory.dmp

Filesize
112KB

Download
memory/1904-8-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/1904-9-0x00000000001B0000-0x00000000001CC000-memory.dmp

Filesize
112KB

Download
memory/1904-25-0x00000000001B0000-0x00000000001CC000-memory.dmp

Filesize
112KB

Download
memory/1904-6-0x00000000001B0000-0x00000000001CC000-memory.dmp

Filesize
112KB

Download
memory/1924-74-0x0000000075360000-0x000000007537C000-memory.dmp

Filesize
112KB

Download
memory/1924-73-0x0000000075360000-0x000000007537C000-memory.dmp

Filesize
112KB

Download
memory/2080-0-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2080-26-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2080-55-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2080-3-0x0000000000220000-0x000000000023C000-memory.dmp

Filesize
112KB

Download
memory/2316-16-0x0000000074E90000-0x0000000074EAC000-memory.dmp

Filesize
112KB

Download
memory/2316-15-0x0000000074E90000-0x0000000074EAC000-memory.dmp

Filesize
112KB

Download
memory/2404-88-0x0000000075360000-0x000000007537C000-memory.dmp

Filesize
112KB

Download
memory/2404-86-0x0000000075360000-0x000000007537C000-memory.dmp

Filesize
112KB

Download
memory/2556-31-0x0000000074E90000-0x0000000074EAC000-memory.dmp

Filesize
112KB

Download
memory/2556-30-0x0000000074E90000-0x0000000074EAC000-memory.dmp

Filesize
112KB

Download
memory/2712-22-0x0000000074940000-0x000000007495C000-memory.dmp

Filesize
112KB

Download
memory/2712-23-0x0000000074940000-0x000000007495C000-memory.dmp

Filesize
112KB

Download
memory/2744-42-0x0000000074E90000-0x0000000074EAC000-memory.dmp

Filesize
112KB

Download
memory/2744-41-0x0000000074E90000-0x0000000074EAC000-memory.dmp

Filesize
112KB

Download
memory/2748-47-0x0000000074E90000-0x0000000074EAC000-memory.dmp

Filesize
112KB

Download
memory/2748-49-0x0000000074E90000-0x0000000074EAC000-memory.dmp

Filesize
112KB

Download
memory/2748-48-0x0000000074E90000-0x0000000074EAC000-memory.dmp

Filesize
112KB

Download
memory/2944-79-0x0000000075360000-0x000000007537C000-memory.dmp

Filesize
112KB

Download
memory/3044-35-0x0000000074E90000-0x0000000074EAC000-memory.dmp

Filesize
112KB

Download
memory/3044-36-0x0000000074E90000-0x0000000074EAC000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads