Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04-02-2024 10:22
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exe
Resource
win7-20231129-en
General
-
Target
2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exe
-
Size
388KB
-
MD5
03524f8d7f9ae93720f34293ecfe3130
-
SHA1
3b4f7bdceb3efce697b48aabae0a1c8b3d045415
-
SHA256
b6bf4fffe1fc94a1f44fd05a8782291d113486db5fcfa9cf04b80a7f816d727e
-
SHA512
e85dd5420b9616330fbb50f3e6d7f7f2690907c3bcd166829a9d5be5141dbddeb3b5d0e0bc3249d12ab33ae23776c89d75bf51796d5daec6d885dfa8aa1fc9e2
-
SSDEEP
6144:7KIHCIcX4WScpdOQRFSFRxc0gmKMBISphOxkTtsHNnL4BjxAtI0pjfK89l:7xCTX4WrhFSF3c8KwJEL4BjCI0xz/
Malware Config
Extracted
emotet
Epoch1
104.236.137.72:8080
172.104.233.225:8080
213.189.36.51:8080
85.234.143.94:8080
119.59.124.163:8080
190.146.131.105:8080
186.23.132.93:990
200.113.106.18:80
163.172.40.218:7080
187.190.49.92:443
201.190.133.235:8080
46.28.111.142:7080
104.131.58.132:8080
14.160.93.230:80
201.163.74.202:443
200.124.225.32:80
203.130.0.69:80
181.36.42.205:443
182.48.194.6:8090
87.106.77.40:7080
190.97.30.167:990
91.83.93.124:7080
190.195.129.227:8090
50.28.51.143:8080
189.173.113.67:443
181.231.62.54:80
109.169.86.13:8080
86.42.166.147:80
186.0.68.43:8443
183.82.97.25:80
96.20.84.254:7080
159.203.204.126:8080
68.183.190.199:8080
201.213.32.59:80
46.101.212.195:8080
186.15.83.52:8080
181.198.203.45:443
62.75.143.100:7080
69.163.33.84:8080
149.62.173.247:8080
88.250.223.190:8080
125.99.61.162:7080
190.186.164.23:80
181.135.153.203:443
178.79.163.131:8080
142.93.114.137:8080
154.120.227.206:8080
181.61.143.177:80
190.16.101.10:80
142.127.57.63:8080
138.68.106.4:7080
68.183.170.114:8080
134.209.214.126:8080
185.86.148.222:8080
186.68.48.204:443
190.102.226.91:80
191.103.76.34:443
91.204.163.19:8090
190.210.184.138:995
200.123.101.90:80
190.38.14.52:80
45.79.95.107:443
5.196.35.138:7080
86.142.102.191:8443
200.58.83.179:80
80.85.87.122:8080
190.4.50.26:80
203.25.159.3:8080
212.71.237.140:8080
217.199.160.224:8080
187.230.99.192:443
81.213.215.216:50000
87.118.70.69:8080
186.1.41.111:443
77.55.211.77:8080
139.5.237.27:443
62.75.160.178:8080
51.255.165.160:8080
207.154.204.40:8080
82.196.15.205:8080
190.17.42.79:80
91.205.215.57:7080
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
publishstuck.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat publishstuck.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 25 IoCs
Processes:
publishstuck.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B55497E4-EE4B-4BC9-81F6-C857A9E2C0AB}\de-f0-1e-3e-4b-85 publishstuck.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 publishstuck.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B55497E4-EE4B-4BC9-81F6-C857A9E2C0AB}\WpadDecision = "0" publishstuck.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B55497E4-EE4B-4BC9-81F6-C857A9E2C0AB}\WpadDecisionTime = 00c6421a5457da01 publishstuck.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B55497E4-EE4B-4BC9-81F6-C857A9E2C0AB}\WpadNetworkName = "Network 3" publishstuck.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-f0-1e-3e-4b-85\WpadDecisionTime = 00c6421a5457da01 publishstuck.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f003a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 publishstuck.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings publishstuck.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B55497E4-EE4B-4BC9-81F6-C857A9E2C0AB}\WpadDecisionReason = "1" publishstuck.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-f0-1e-3e-4b-85\WpadDecisionReason = "1" publishstuck.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-f0-1e-3e-4b-85\WpadDecisionTime = a0e3bb3d5457da01 publishstuck.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" publishstuck.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f003a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 publishstuck.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" publishstuck.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B55497E4-EE4B-4BC9-81F6-C857A9E2C0AB} publishstuck.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" publishstuck.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-f0-1e-3e-4b-85 publishstuck.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings publishstuck.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-f0-1e-3e-4b-85\WpadDetectedUrl publishstuck.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections publishstuck.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 publishstuck.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B55497E4-EE4B-4BC9-81F6-C857A9E2C0AB}\WpadDecisionTime = a0e3bb3d5457da01 publishstuck.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad publishstuck.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-f0-1e-3e-4b-85\WpadDecision = "0" publishstuck.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix publishstuck.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
publishstuck.exepid process 2092 publishstuck.exe 2092 publishstuck.exe 2092 publishstuck.exe 2092 publishstuck.exe 2092 publishstuck.exe 2092 publishstuck.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exepid process 2172 2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exe2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exepublishstuck.exepublishstuck.exepid process 1924 2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exe 2172 2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exe 1904 publishstuck.exe 2092 publishstuck.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exepublishstuck.exedescription pid process target process PID 1924 wrote to memory of 2172 1924 2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exe 2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exe PID 1924 wrote to memory of 2172 1924 2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exe 2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exe PID 1924 wrote to memory of 2172 1924 2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exe 2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exe PID 1924 wrote to memory of 2172 1924 2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exe 2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exe PID 1904 wrote to memory of 2092 1904 publishstuck.exe publishstuck.exe PID 1904 wrote to memory of 2092 1904 publishstuck.exe publishstuck.exe PID 1904 wrote to memory of 2092 1904 publishstuck.exe publishstuck.exe PID 1904 wrote to memory of 2092 1904 publishstuck.exe publishstuck.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid.exe--3a9d37722⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\publishstuck.exe"C:\Windows\SysWOW64\publishstuck.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\publishstuck.exe--86c9fabf2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1904-11-0x00000000003E0000-0x00000000003F7000-memory.dmpFilesize
92KB
-
memory/1924-0-0x0000000000270000-0x0000000000287000-memory.dmpFilesize
92KB
-
memory/1924-5-0x0000000000250000-0x0000000000261000-memory.dmpFilesize
68KB
-
memory/1924-21-0x0000000000250000-0x0000000000261000-memory.dmpFilesize
68KB
-
memory/2092-16-0x00000000002A0000-0x00000000002B7000-memory.dmpFilesize
92KB
-
memory/2172-6-0x00000000003C0000-0x00000000003D7000-memory.dmpFilesize
92KB