Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12-02-2024 20:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-12_d650c129e76087f6e9d88b94e0c6bd4f_icedid.exe
Resource
win7-20231215-en
General
-
Target
2024-02-12_d650c129e76087f6e9d88b94e0c6bd4f_icedid.exe
-
Size
712KB
-
MD5
d650c129e76087f6e9d88b94e0c6bd4f
-
SHA1
2dcc4d01f807f43102a71f0c3a1271b671772fea
-
SHA256
b552b7b3d0945bd2ee045ee5cfdd16bf7fe4afb275649adb092700e39baeb2d0
-
SHA512
893db9258b6aa680d7bd76e9cc7d9e1bfd529d65a513af53766a8fcb0a2f7831cba63bdab16f615be9ca15895ba48c04985db643e28fd801c264551e4baa566b
-
SSDEEP
12288:JOiN7MvENaFrB3tCexKQbLAgB6uE9TSbwbZOSsDLMg2JtYGDf:JJGHdfxKQlBTE9TSb2ULMJtYGT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
8759.tmppid process 2996 8759.tmp -
Loads dropped DLL 2 IoCs
Processes:
2024-02-12_d650c129e76087f6e9d88b94e0c6bd4f_icedid.exepid process 1708 2024-02-12_d650c129e76087f6e9d88b94e0c6bd4f_icedid.exe 1708 2024-02-12_d650c129e76087f6e9d88b94e0c6bd4f_icedid.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
Processes:
8759.tmpdescription ioc process File created C:\Windows\SysWOW64\mswstr10.dll 8759.tmp File created C:\Windows\SysWOW64\odbcjt32.dll 8759.tmp File opened for modification C:\Windows\SysWOW64\vcomp140.dll 8759.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igd10umd32.dll 8759.tmp File created C:\Windows\SysWOW64\explorer.exe 8759.tmp File opened for modification C:\Windows\SysWOW64\mfc140.dll 8759.tmp File created C:\Windows\SysWOW64\rdvgumd32.dll 8759.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\amdpcom32.dll 8759.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atidxx32.dll 8759.tmp File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\MediaPlayer-DLMigPlugin.dll 8759.tmp File created C:\Windows\SysWOW64\ir32_32.dll 8759.tmp File created C:\Windows\SysWOW64\msvbvm60.dll 8759.tmp File opened for modification C:\Windows\SysWOW64\VBAME.DLL 8759.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igdumd32.dll 8759.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvd3dum.dll 8759.tmp File created C:\Windows\SysWOW64\migration\MediaPlayer-DLMigPlugin.dll 8759.tmp File opened for modification C:\Windows\SysWOW64\mfc100u.dll 8759.tmp File created C:\Windows\SysWOW64\msjet40.dll 8759.tmp File created C:\Windows\SysWOW64\msexcl40.dll 8759.tmp File opened for modification C:\Windows\SysWOW64\mfc120.dll 8759.tmp File opened for modification C:\Windows\SysWOW64\mfc140u.dll 8759.tmp File opened for modification C:\Windows\SysWOW64\mfc110u.dll 8759.tmp File created C:\Windows\SysWOW64\mfc40.dll 8759.tmp File created C:\Windows\SysWOW64\msexch40.dll 8759.tmp File created C:\Windows\SysWOW64\msjtes40.dll 8759.tmp File created C:\Windows\SysWOW64\msrepl40.dll 8759.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvwgf2um.dll 8759.tmp File created C:\Windows\SysWOW64\FXSXP32.dll 8759.tmp File opened for modification C:\Windows\SysWOW64\mfc110.dll 8759.tmp File created C:\Windows\SysWOW64\ivfsrc.ax 8759.tmp File opened for modification C:\Windows\SysWOW64\MSCOMCTL.OCX 8759.tmp File created C:\Windows\SysWOW64\sqlwoa.dll 8759.tmp File created C:\Windows\SysWOW64\dplayx.dll 8759.tmp File created C:\Windows\SysWOW64\ir50_32.dll 8759.tmp File created C:\Windows\SysWOW64\regedit.exe 8759.tmp File created C:\Windows\SysWOW64\msvcrt20.dll 8759.tmp File created C:\Windows\SysWOW64\msxbde40.dll 8759.tmp File opened for modification C:\Windows\SysWOW64\msvcr120.dll 8759.tmp File created C:\Windows\SysWOW64\mswdat10.dll 8759.tmp File created C:\Windows\SysWOW64\InstallShield\setup.exe 8759.tmp File opened for modification C:\Windows\SysWOW64\mfc120u.dll 8759.tmp File created C:\Windows\SysWOW64\msjter40.dll 8759.tmp File opened for modification C:\Windows\SysWOW64\concrt140.dll 8759.tmp File created C:\Windows\SysWOW64\d3dim.dll 8759.tmp File created C:\Windows\SysWOW64\d3dxof.dll 8759.tmp File opened for modification C:\Windows\SysWOW64\mfc100.dll 8759.tmp File created C:\Windows\SysWOW64\msltus40.dll 8759.tmp File opened for modification C:\Windows\SysWOW64\atl100.dll 8759.tmp File created C:\Windows\SysWOW64\audiodev.dll 8759.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdva.dll 8759.tmp File created C:\Windows\SysWOW64\dpwsockx.dll 8759.tmp File created C:\Windows\SysWOW64\iac25_32.ax 8759.tmp File opened for modification C:\Windows\SysWOW64\msvcr120_clr0400.dll 8759.tmp File created C:\Windows\SysWOW64\sqlunirl.dll 8759.tmp File opened for modification C:\Windows\SysWOW64\atl110.dll 8759.tmp File created C:\Windows\SysWOW64\dplaysvr.exe 8759.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdag.dll 8759.tmp File created C:\Windows\SysWOW64\expsrv.dll 8759.tmp File created C:\Windows\SysWOW64\msrd2x40.dll 8759.tmp File created C:\Windows\SysWOW64\mfc40u.dll 8759.tmp File created C:\Windows\SysWOW64\msorcl32.dll 8759.tmp File created C:\Windows\SysWOW64\mspbde40.dll 8759.tmp File created C:\Windows\SysWOW64\mstext40.dll 8759.tmp File opened for modification C:\Windows\SysWOW64\msvcr100.dll 8759.tmp -
Drops file in Program Files directory 64 IoCs
Processes:
8759.tmpdescription ioc process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\MSB1FREN.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\STSCOPY.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEOLEDB.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OFFOWC.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLFLTR.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DELIMWIN.FAE 8759.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\USP10.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\IMCONTACT.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE 8759.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api 8759.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api 8759.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp 8759.tmp File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe 8759.tmp File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\MSADDNDR.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCNPST32.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7EN.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7ES.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEXBE.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCVDT.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IMPMAIL.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MCPS.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\MSGR3ES.DLL 8759.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCDDS.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INTLDATE.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OISGRAPH.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLMAIL.FAE 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOCFUIUTILITIESDLL.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPSLAX.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AiodLite.dll 8759.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\sqlite.dll 8759.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\PROOF\MSLID.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONTAB32.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EMABLT32.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DESKSAM.SAM 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OL.SAM 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7FR.DLL 8759.tmp File opened for modification C:\Program Files\7-Zip\7zCon.sfx 8759.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIBUtils.dll 8759.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCDDSF.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OLMAPI32.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7ES.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\EPSIMP32.FLT 8759.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\MOFL.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OART.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIMG.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OWSSUPP.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp 8759.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACETXT.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLMIME.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\VBE7.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ContactPicker.dll 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOCF.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\TWCUTCHR.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE 8759.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\RM.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll 8759.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api 8759.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FPERSON.DLL 8759.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1XTOR.DLL 8759.tmp -
Drops file in Windows directory 64 IoCs
Processes:
8759.tmpdescription ioc process File created C:\Windows\winsxs\x86_microsoft-windows-ieinstal_31bf3856ad364e35_8.0.7601.17514_none_055d8a4166e66f09\ieinstal.exe 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_6.1.7600.16385_none_5ae7f926deb5de01\rdrleakdiag.exe 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-tasklist_31bf3856ad364e35_6.1.7600.16385_none_28198854bba53a00\tasklist.exe 8759.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-atl_31bf3856ad364e35_6.1.7600.16385_none_aaf695e9bb060258_atl.dll_0c7220db 8759.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-htmlhelp-infotech_31bf3856ad364e35_6.1.7601.17514_none_f8ab56ff71fc562a_itircl.dll_dafa7917 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-content-filter-office_31bf3856ad364e35_7.0.7600.16385_none_3258451e823925d2\offfilt.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_ef38a8d0d05cc2c7\IMJPUEX.EXE 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_6.1.7601.17514_none_720e868d9b0b6a44\WerFaultSecure.exe 8759.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-uxtheme_31bf3856ad364e35_6.1.7600.16385_none_0c2e36cd54a163b4_uxtheme.dll_9f6cda06 8759.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601.17514_none_b7c78d327d35e10e_t2embed.dll_66e8486f 8759.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_21ceb2d66a98ec2f\mofcomp.exe 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_6.1.7601.17514_none_720e868d9b0b6a44\WerFault.exe 8759.tmp File created C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c2\msvcr90.dll 8759.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_6.1.7601.17514_none_42ee5aff60183c81\iscsium.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-atl_31bf3856ad364e35_6.1.7600.16385_none_aaf695e9bb060258\atl.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_6.1.7601.17514_none_b85a4f21afbb528a\spwizeng.dll 8759.tmp File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\sqmapi.dll 8759.tmp File created C:\Windows\winsxs\wow64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_dbd4d2796675bc72\mssph.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..-components-jet2x3x_31bf3856ad364e35_6.1.7600.16385_none_e77583b71bc39457\msrd3x40.dll 8759.tmp File created C:\Windows\winsxs\x86_netfx-clr_sys_entservcs_thunk_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_26e756d174266d3a\System.EnterpriseServices.Thunk.dll 8759.tmp File created C:\Windows\winsxs\x86_netfx-mscorpe_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_cc40233618db40f9\mscorpe.dll 8759.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-ieframe_31bf3856ad364e35_8.0.7601.17514_none_e7d7639870214e02\ieui.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-d..-mmc-usersandgroups_31bf3856ad364e35_6.1.7601.17514_none_05e47e97e02a316a\localsec.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-setup-support_31bf3856ad364e35_8.0.7601.17514_none_e292664733bd5af6\iernonce.dll 8759.tmp File created C:\Windows\winsxs\x86_netfx-clrgc_b03f5f7f11d50a3a_6.1.7601.17514_none_f5276fe6b5adf276\clrgc.exe 8759.tmp File created C:\Windows\winsxs\x86_netfx-fw_netfxperf_dll_31bf3856ad364e35_6.2.7601.17514_none_5ec9dfb2784680fc\netfxperf.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-winrsplugins_31bf3856ad364e35_6.1.7600.16385_none_160ccc8a92fae520\winrscmd.dll 8759.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlediting_31bf3856ad364e35_8.0.7601.17514_none_cb5de060056709ad\mshtmled.dll 8759.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.2.9600.16428_none_23d2258c5d920952\occache.dll 8759.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\iisreset.exe 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_6.1.7601.17514_none_2d3b8ff08901343f\DismHost.exe 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..eplacementmanifests_31bf3856ad364e35_6.1.7601.17514_none_fdfbc5f949b9a49e\ndismigplugin.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpshell_31bf3856ad364e35_6.1.7601.17514_none_0dcec3a3a390e9bf\wmpshell.dll 8759.tmp File created C:\Windows\winsxs\x86_netfx-ado_net_diag_b03f5f7f11d50a3a_6.1.7600.16385_none_41e26933a436d37d\AdoNetDiag.dll 8759.tmp File created C:\Windows\winsxs\x86_netfx-perfcounter_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_fe5e474bbbf4bf39\PerfCounter.dll 8759.tmp File created C:\Windows\winsxs\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_6.1.7601.17514_none_9809be824da2c173\vbc.exe 8759.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-ieframe_31bf3856ad364e35_8.0.7601.17514_none_e7d7639870214e02\ieframe.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-rastls_31bf3856ad364e35_6.1.7601.17514_none_6e6c95d9ae65f958\rastls.dll 8759.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.2.9600.16428_none_ffeecffc6b986ebd\mshtml.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..drivermanager-trace_31bf3856ad364e35_6.1.7601.17514_none_817af6649fbc1ed4\odbctrac.dll 8759.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_6.1.7600.16385_none_2831d06e8295c671\upnphost.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-c..fe-catsrvut-comsvcs_31bf3856ad364e35_6.1.7600.16385_none_7298bb510131906e\catsrvut.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directx-direct3d10.1_31bf3856ad364e35_6.1.7601.17514_none_5230e75107d43005\d3d10_1core.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..-downlevelmanifests_31bf3856ad364e35_6.1.7601.17514_none_04801f69e1dbd8e6\drmmgrtn.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-r..ement-client-v1-api_31bf3856ad364e35_6.1.7601.17514_none_ea0506c3f186aaf1\msdrm.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-htmlconverter_31bf3856ad364e35_8.0.7601.17514_none_87da61075c9f17a8\html.iec 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..eplacementmanifests_31bf3856ad364e35_6.1.7601.17514_none_fdfbc5f949b9a49e\tsmigplugin.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-systemrestore-srhelper_31bf3856ad364e35_6.1.7600.16385_none_aebaae1fbbd1273c\srhelper.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-t..platform-comruntime_31bf3856ad364e35_6.1.7600.16385_none_ca66ddfc9862f744\InkEd.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.4148_none_4bf5400abf9d60b7\mfc90u.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wmadmod_31bf3856ad364e35_6.1.7601.17514_none_885655287c3a2a8e\WMADMOD.DLL 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directwrite_31bf3856ad364e35_6.1.7601.17514_none_d4a4d90d5db128bf\DWrite.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-htmlconverter_31bf3856ad364e35_11.2.9600.16428_none_f151276ee40bc690\html.iec 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-rasmm_31bf3856ad364e35_6.1.7600.16385_none_61704a21bdb8c569\RASMM.dll 8759.tmp File created C:\Windows\winsxs\x86_netfx35linq-csharp_31bf3856ad364e35_6.1.7601.17514_none_193318f5726bf1d7\csc.exe 8759.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-wintrust-dll_31bf3856ad364e35_6.1.7601.17514_none_f1b5a3b0f852fe0e_wintrust.dll_abec426a 8759.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-scripting-jscript_31bf3856ad364e35_8.0.7601.17514_none_0614df8fb9269bc6\jscript.dll 8759.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-t..andinkinputservices_31bf3856ad364e35_6.1.7600.16385_none_82f6c6cd67248bc4\tiptsf.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-ieshims_31bf3856ad364e35_8.0.7601.17514_none_644ee1186f7d145b\IEShims.dll 8759.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-ldap-client_31bf3856ad364e35_6.1.7601.17514_none_f543b182b4adcce6_wldap32.dll_09c99dc1 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-i..-setieinstalleddate_31bf3856ad364e35_11.2.9600.16428_none_8eaf79351dba1b94\SetIEInstalledDate.exe 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-i..ersandsecurityzones_31bf3856ad364e35_11.2.9600.16428_none_3b1b8f66337aabc3\urlmon.dll 8759.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-devtools_31bf3856ad364e35_11.2.9600.16428_none_c1dd845a9c871e97\iedvtool.dll 8759.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-uiribbon_31bf3856ad364e35_6.1.7601.17514_none_db578bdb5e3559c6\UIRibbon.dll 8759.tmp -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
2024-02-12_d650c129e76087f6e9d88b94e0c6bd4f_icedid.exepid process 1708 2024-02-12_d650c129e76087f6e9d88b94e0c6bd4f_icedid.exe 1708 2024-02-12_d650c129e76087f6e9d88b94e0c6bd4f_icedid.exe 1708 2024-02-12_d650c129e76087f6e9d88b94e0c6bd4f_icedid.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-02-12_d650c129e76087f6e9d88b94e0c6bd4f_icedid.exedescription pid process target process PID 1708 wrote to memory of 2996 1708 2024-02-12_d650c129e76087f6e9d88b94e0c6bd4f_icedid.exe 8759.tmp PID 1708 wrote to memory of 2996 1708 2024-02-12_d650c129e76087f6e9d88b94e0c6bd4f_icedid.exe 8759.tmp PID 1708 wrote to memory of 2996 1708 2024-02-12_d650c129e76087f6e9d88b94e0c6bd4f_icedid.exe 8759.tmp PID 1708 wrote to memory of 2996 1708 2024-02-12_d650c129e76087f6e9d88b94e0c6bd4f_icedid.exe 8759.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_d650c129e76087f6e9d88b94e0c6bd4f_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_d650c129e76087f6e9d88b94e0c6bd4f_icedid.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\8759.tmpC:\Users\Admin\AppData\Local\Temp\8759.tmp2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD5674df80623631df510e18674e15bd057
SHA17e12a50332bc4886df43953de6d60e7cc5e86740
SHA2564268f759b70b4596d96a525047726797535b3a8098e01c389f6cd1a7ea998883
SHA512e9f3f981f04f6f6a9f0869de97c96915848b188cd8393eee5b1b1f207a9be36f607ae1c52fee8cdefe2a1ae7d28a03b502901eaff0ef47dbd9d7ce2719512d50
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666