d3904bfc172d013a6f4a13b6730a64eb2b48cdb0290f410b946f995224e1f4fa

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-02_a1af92491a9e626e0c2ba624f0b3af1e_icedid.exe
Size

284KB
MD5

a1af92491a9e626e0c2ba624f0b3af1e
SHA1

b122341d56d619de0d25b4198fc071be2cd44a70
SHA256

d3904bfc172d013a6f4a13b6730a64eb2b48cdb0290f410b946f995224e1f4fa
SHA512

1adbcde1c3de3c368794c98023a61df757c85d8b0f75f08b6d1751e1653109c32a9e41c4168c2578b473c173681495edb9fb4d20c8aa9d00555a76f1acde373c
SSDEEP

6144:hlDx7mlcAZBcIdqkorDfoR/0C1fzDB9ePHSJ:hlDx7mlHZo7HoRv177ePH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2344	sethome8598.exe

Loads dropped DLL 2 IoCs

pid	Process
1680	2024-02-02_a1af92491a9e626e0c2ba624f0b3af1e_icedid.exe
1680	2024-02-02_a1af92491a9e626e0c2ba624f0b3af1e_icedid.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\sethome8598.exe	2024-02-02_a1af92491a9e626e0c2ba624f0b3af1e_icedid.exe
File created	\??\c:\windows\system\sethome8598.exe	2024-02-02_a1af92491a9e626e0c2ba624f0b3af1e_icedid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.baiduo.org/"	2024-02-02_a1af92491a9e626e0c2ba624f0b3af1e_icedid.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1680	2024-02-02_a1af92491a9e626e0c2ba624f0b3af1e_icedid.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1680	2024-02-02_a1af92491a9e626e0c2ba624f0b3af1e_icedid.exe
1680	2024-02-02_a1af92491a9e626e0c2ba624f0b3af1e_icedid.exe
1680	2024-02-02_a1af92491a9e626e0c2ba624f0b3af1e_icedid.exe
1680	2024-02-02_a1af92491a9e626e0c2ba624f0b3af1e_icedid.exe
2344	sethome8598.exe
2344	sethome8598.exe
2344	sethome8598.exe
2344	sethome8598.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2344	1680	2024-02-02_a1af92491a9e626e0c2ba624f0b3af1e_icedid.exe	34
PID 1680 wrote to memory of 2344	1680	2024-02-02_a1af92491a9e626e0c2ba624f0b3af1e_icedid.exe	34
PID 1680 wrote to memory of 2344	1680	2024-02-02_a1af92491a9e626e0c2ba624f0b3af1e_icedid.exe	34
PID 1680 wrote to memory of 2344	1680	2024-02-02_a1af92491a9e626e0c2ba624f0b3af1e_icedid.exe	34

C:\Users\Admin\AppData\Local\Temp\2024-02-02_a1af92491a9e626e0c2ba624f0b3af1e_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-02_a1af92491a9e626e0c2ba624f0b3af1e_icedid.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- \??\c:\windows\system\sethome8598.exe
  c:\windows\system\sethome8598.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\abc.lnk

Filesize
965B

MD5
bfcb63cb9344d34eb8440263ef72fdff

SHA1
84b9e24a12eb809cb948bd5bf418483c9a54542d

SHA256
33fe0bd2fec8c002e938742a216c4eff80528cacd374cc5f3d70fdd6cd81355d

SHA512
b1b1653773feaeb1e0817f1fe17c46f4fa7159b3669f2573277d6e604bfaf19b998d660420dc6e35b84491e274ceb86f5eff1c2cebd27a0079945a9c1cc140fa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk

Filesize
1KB

MD5
44fffeb2f48f7016664ca80b00d84041

SHA1
b2b5a8598d1149fe16d8472cf77a3bb1df3717c3

SHA256
cf5b87a56666093dcc31626740c8e62aa79629ea8c4e19d34b692fb4f30baf12

SHA512
d86a5b1c19a1d54713d7fc60fddf13406fb28c090e80d8e50d4d988a7104d97538216da90c5ac0eb28cf92b8621d2c613638b2b4fc96a61955b345eacc7aee28

Download Submit
C:\Users\abc.lnk

Filesize
1KB

MD5
652a3160d63b2a4ed4cfa41d662fc2f3

SHA1
68d180ccf70bbe8a98c2524df80cd73bad1f89b9

SHA256
9328a2457d3fbd606b38b2cb9f3332f01c5ddc4d6e32d30540ca01aefa991c1c

SHA512
5838d0bbb813ce9dff71e90a51a31e483a34d1380bf2cef04218718b1ccdb5c20df28293bddbf8e05f88b114dd2b3a11b1549dfd96fb2c886a58e991a675c690

Download Submit
\Windows\system\sethome8598.exe

Filesize
284KB

MD5
2c52cf7b633d8408959270a2318d023a

SHA1
6070bb53bb37bae5b8fc8badd97cba8185939a02

SHA256
74d91d5d4fc61e617d3fab74f639df7c43956af35e6fbc63f95298c11a390b1c

SHA512
dd0760b463367dffd1c9d9bdb1eccf12130367801ef4c18da022b0bd1f616624200a607d30a0439e1807509669dd33bf76c55259c5091aa8c84c7d9e9f022597

Download Submit