Static task
static1
Behavioral task
behavioral1
Sample
2024-02-23_883275aa2230eb4b8edb0ae9d26c3580_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-23_883275aa2230eb4b8edb0ae9d26c3580_icedid.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-23_883275aa2230eb4b8edb0ae9d26c3580_icedid
-
Size
2.1MB
-
MD5
883275aa2230eb4b8edb0ae9d26c3580
-
SHA1
0692bdd2c80fe2e85bc263bf7fbc6e5d2406dcd1
-
SHA256
bf6f9101245b79b89e983b4a81aa605ae083fd4716b1efb5dd23deb0995fa5f0
-
SHA512
41501c344f6e2bb18730b527a9a82cede9d1155c03b77bca689a5bc81219244508ad08cb6292c77870109422bb049e17fc1d534f316162023c4e84133fa7b457
-
SSDEEP
24576:YOfAKTUw+T/HUpAMOSR8H0cvR1Kg4b/Rggv9NcvtdlCzyKbW4GBT9jPGddk2Oyt:RIT/HU5ON5qB5z9NWBcyuGBT9TQkPyt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-02-23_883275aa2230eb4b8edb0ae9d26c3580_icedid
Files
-
2024-02-23_883275aa2230eb4b8edb0ae9d26c3580_icedid.exe windows:4 windows x86 arch:x86
52ae5e5ff2471514fda0bcc3c853e8de
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
setsockopt
connect
socket
WSACleanup
WSAGetLastError
WSAStartup
closesocket
shutdown
htons
gethostbyname
recv
send
ntohs
getservbyname
gethostbyaddr
ioctlsocket
comctl32
ImageList_ReplaceIcon
ImageList_Destroy
InitCommonControlsEx
ord17
ImageList_Add
ImageList_GetIconSize
ImageList_AddMasked
ImageList_Draw
ImageList_SetBkColor
ImageList_GetImageInfo
ImageList_DrawEx
PropertySheetW
CreatePropertySheetPageW
ImageList_Create
mpr
WNetGetConnectionW
wininet
InternetCanonicalizeUrlW
FtpOpenFileW
InternetQueryDataAvailable
InternetReadFile
InternetOpenW
InternetConnectW
FtpFindFirstFileW
FtpGetFileW
InternetCloseHandle
crpe32
ord60
ord59
ord58
ord53
ord1138
ord1154
ord1133
ord1134
ord1005
ord1004
ord1002
ord1001
ord1000
ord130
ord1179
ord57
ord1041
ord1040
ord11
ord67
ord40
ord47
ord17
ord1418
ord41
ord109
ord1007
ord10
ord1158
ord1008
ord1009
ord8
ord1320
ord1322
ord1324
ord9
ord135
ord12
ord6
ord75
ord35
ord36
ord129
ord37
ord7
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
shlwapi
PathIsUNCW
AssocQueryStringW
PathAppendW
PathIsURLW
odbc32
ord136
secur32
DeleteSecurityContext
InitializeSecurityContextA
LsaConnectUntrusted
LsaLookupAuthenticationPackage
LsaCallAuthenticationPackage
LsaFreeReturnBuffer
FreeContextBuffer
QuerySecurityPackageInfoA
AcquireCredentialsHandleA
ntdsapi
DsMakeSpnA
shfolder
SHGetFolderPathW
mapi32
ord123
kernel32
GlobalHandle
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
OpenMutexW
GetProcessTimes
GetStartupInfoW
MultiByteToWideChar
SearchPathW
GetUserDefaultLCID
GlobalMemoryStatus
GetSystemInfo
lstrlenA
LocalAlloc
GetModuleHandleA
GetVersion
GetCommandLineW
GetFileTime
SystemTimeToFileTime
GetProcessIoCounters
TerminateProcess
GetComputerNameExA
GetComputerNameA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetStdHandle
LoadLibraryA
SetEnvironmentVariableA
UnlockFileEx
LockFileEx
CreateProcessA
DuplicateHandle
CreatePipe
LocalUnlock
LocalLock
GetModuleFileNameA
MoveFileExA
CreateFileA
GetSystemDirectoryA
GetCurrentDirectoryA
GetFullPathNameA
DeleteFileA
GetDriveTypeA
CompareStringW
CompareStringA
GetExitCodeProcess
IsBadCodePtr
IsBadReadPtr
GetOEMCP
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetCPInfo
GetStringTypeW
GetStringTypeA
GetFileAttributesA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetEnvironmentVariableW
SetHandleCount
GetTimeZoneInformation
QueryPerformanceCounter
SetUnhandledExceptionFilter
LCMapStringW
LCMapStringA
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
VirtualQuery
VirtualAlloc
VirtualProtect
FindFirstFileA
SetConsoleCtrlHandler
GetFileType
SetStdHandle
GetCommandLineA
GetStartupInfoA
GetSystemTimeAsFileTime
ExitProcess
OutputDebugStringA
RtlUnwind
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
SetEndOfFile
FlushFileBuffers
GlobalFlags
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
lstrcatW
lstrcmpW
GetVersionExA
lstrcpyW
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
LeaveCriticalSection
lstrlenW
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
RaiseException
lstrcpynW
GetConsoleCP
CloseHandle
GetACP
ReadFile
GetFileSize
CreateFileW
GetBinaryTypeW
CreateMutexW
ReleaseMutex
WaitForSingleObject
LocalFree
FormatMessageW
GetCurrentProcessId
DeleteFileW
FindClose
GetPrivateProfileStringW
FindNextFileW
FindFirstFileW
GetModuleFileNameW
GetModuleHandleW
GetLocalTime
GetLastError
SetFilePointer
WriteFile
GetTempFileNameW
ExitThread
LoadLibraryW
FreeLibrary
GetSystemTime
GlobalFree
CreateThread
ResetEvent
CreateEventW
Sleep
GetVolumeInformationW
GetTickCount
GetExitCodeThread
SetEvent
GetCurrentThreadId
GlobalAlloc
GlobalUnlock
GlobalLock
GetDriveTypeW
WritePrivateProfileStringW
GetPrivateProfileSectionW
GetProcAddress
InterlockedExchange
GetLocaleInfoA
GetVersionExW
GetLocaleInfoW
CopyFileW
GetFileAttributesW
InterlockedIncrement
MulDiv
InterlockedDecrement
GetDateFormatW
GetTimeFormatW
FindResourceW
CreateDirectoryW
GetEnvironmentVariableW
SetFileTime
OpenProcess
LoadResource
LockResource
TerminateThread
OpenEventW
GlobalReAlloc
CompareFileTime
GetTempPathA
OutputDebugStringW
WideCharToMultiByte
SetFileAttributesW
RemoveDirectoryW
GetTempPathW
GetLongPathNameW
GetCurrentProcess
SetLastError
GetComputerNameW
CreateProcessW
user32
GetMenuItemID
MapVirtualKeyW
GetKeyNameTextW
CheckMenuRadioItem
GetSubMenu
GetMenuItemInfoW
ClientToScreen
GetCaretPos
CreatePopupMenu
InsertMenuItemW
DeleteMenu
AnimateWindow
TranslateMDISysAccel
SetCursorPos
GetLastActivePopup
IsIconic
GetDlgItemInt
GetNextDlgTabItem
GetClipboardData
RegisterClipboardFormatW
SetMenuItemInfoW
CreateMenu
EnumDisplaySettingsW
TrackPopupMenuEx
CreateDialogParamW
LoadStringW
RegisterClassW
LoadIconW
GetClassInfoW
GetMenuState
GetKeyboardState
SetKeyboardState
BeginPaint
SetClipboardData
EmptyClipboard
OpenClipboard
CloseClipboard
LoadBitmapW
MoveWindow
IsZoomed
GetScrollInfo
GetCursor
LoadMenuW
SetMenu
DrawMenuBar
DestroyMenu
FlashWindow
MessageBoxIndirectW
GetCursorPos
DefMDIChildProcW
GetSysColorBrush
UnhookWindowsHookEx
SetWindowsHookExW
GetDlgItemTextW
IsChild
GetMenu
SetDlgItemTextW
CallNextHookEx
MessageBeep
RedrawWindow
wsprintfW
SetCursor
GetSystemMetrics
DefWindowProcW
FrameRect
InflateRect
FillRect
DrawFrameControl
OffsetRect
DrawTextW
DrawFocusRect
CreateAcceleratorTableW
ReleaseDC
DestroyAcceleratorTable
CopyRect
GetKeyState
TranslateAcceleratorW
GetClassNameW
SetWindowLongW
PtInRect
SetClassLongW
DialogBoxParamW
MsgWaitForMultipleObjectsEx
SetWindowPos
GetDlgItem
SetWindowTextW
EndDialog
MessageBoxW
GetUpdateRect
EnumChildWindows
InvalidateRect
UpdateWindow
GetSysColor
GetWindow
GetFocus
GetWindowLongW
IsClipboardFormatAvailable
GetWindowTextLengthW
EnableWindow
SetTimer
KillTimer
IsDialogMessageW
EnumWindows
IsWindowVisible
GetWindowTextW
PeekMessageW
MsgWaitForMultipleObjects
WaitMessage
GetMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
PostThreadMessageW
LoadImageW
GetDesktopWindow
GetDC
DestroyWindow
GetClassInfoExW
RegisterClassExW
RegisterWindowMessageW
CallWindowProcW
CreateWindowExW
UnregisterClassW
FindWindowExW
ShowWindow
PostMessageW
GetClientRect
GetWindowRect
IsWindowEnabled
ValidateRect
GetMenuCheckMarkDimensions
CheckMenuItem
EnableMenuItem
ModifyMenuW
SetMenuItemBitmaps
SystemParametersInfoA
GetDlgCtrlID
AdjustWindowRectEx
SetForegroundWindow
MapWindowPoints
GetMessagePos
GetMessageTime
GetForegroundWindow
RemovePropW
GetPropW
SetPropW
GetClassLongW
GetCapture
WinHelpW
TabbedTextOutW
DrawTextExW
GrayStringW
TrackMouseEvent
RegisterHotKey
UnregisterHotKey
SetParent
SystemParametersInfoW
FindWindowW
LoadCursorW
EndPaint
SetScrollInfo
ScrollWindow
GetWindowPlacement
GetScrollBarInfo
GetWindowThreadProcessId
IsMenu
GetTopWindow
TileWindows
CascadeWindows
ShowScrollBar
EnableScrollBar
DefFrameProcW
DrawEdge
MessageBoxA
wsprintfA
DestroyIcon
SetFocus
SendMessageW
GetParent
IsWindow
GetActiveWindow
GetMenuItemCount
DrawStateW
gdi32
CreateBitmap
GetClipBox
ExtTextOutW
SaveDC
RestoreDC
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
SetMapMode
PtVisible
RectVisible
StartDocW
StartPage
EndPage
AbortDoc
EndDoc
GetDIBColorTable
GetSystemPaletteUse
GetSystemPaletteEntries
StretchBlt
CreateCompatibleBitmap
EnumFontFamiliesExW
GetTextMetricsW
GetStockObject
CreateFontIndirectW
BitBlt
CreateDCW
GetDeviceCaps
SetBkMode
CreateSolidBrush
CreateCompatibleDC
SetTextColor
SetBkColor
SelectObject
GetTextExtentPoint32W
DeleteDC
CreatePalette
SelectPalette
RealizePalette
SetStretchBltMode
StretchDIBits
DeleteObject
GetObjectW
GetDIBits
Escape
TextOutW
winspool.drv
OpenPrinterW
ord203
EnumPrintersW
ClosePrinter
GetPrinterW
DocumentPropertiesW
comdlg32
PrintDlgW
ReplaceTextW
GetOpenFileNameW
GetSaveFileNameW
FindTextW
ChooseFontW
ChooseColorW
advapi32
IsTextUnicode
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyW
CopySid
GetLengthSid
GetExplicitEntriesFromAclW
GetNamedSecurityInfoW
LsaNtStatusToWinError
GetTokenInformation
GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
SetFileSecurityW
InitializeSecurityDescriptor
FreeSid
OpenProcessToken
SetNamedSecurityInfoW
SetEntriesInAclW
AllocateAndInitializeSid
SetSecurityDescriptorOwner
shell32
ShellExecuteExW
SHGetSpecialFolderPathW
ole32
OleUninitialize
OleInitialize
CoGetObject
CoCreateInstance
CLSIDFromProgID
GetHGlobalFromStream
CreateStreamOnHGlobal
StgCreateDocfile
oleaut32
OleLoadPicture
OleCreatePictureIndirect
OleCreateFontIndirect
VariantChangeType
VariantClear
VarBstrFromCy
VarBstrFromDate
VarI4FromDec
SafeArrayGetDim
SafeArrayGetElement
SafeArrayPutElement
SafeArrayDestroy
SysFreeString
SysAllocString
SysStringLen
VariantInit
SafeArrayCreateVector
msimg32
TransparentBlt
ws2_32
inet_ntoa
gethostname
oleacc
CreateStdAccessibleObject
LresultFromObject
mscoree
_CorExeMain
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 828KB - Virtual size: 824KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ