Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31-03-2024 12:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-31_541795bc71cff09d3743baf59c2baf14_icedid.exe
Resource
win7-20240221-en
General
-
Target
2024-03-31_541795bc71cff09d3743baf59c2baf14_icedid.exe
-
Size
2.4MB
-
MD5
541795bc71cff09d3743baf59c2baf14
-
SHA1
9179b9549e929fa21d74787e135cd1ea07a56f4a
-
SHA256
9e8421d515cd41c76b1ad1780cab6a7d12fc1f54a17ba76cb89f02dcb7dca592
-
SHA512
f8966a98671c18c3f6e45dd6ef93b8a5bc457ca4d95c09f1489470dd0c4c18f55d8614cbd988e98fa3c0c33ff5c7b84e915bd840830f4f1d1114277c5faaac50
-
SSDEEP
49152:1k2Ze+DvSp24SiwRWBFMTxF/W/IhJHdt2ay1aaKo+rGzCpEmZ3On83/I/pIgqyIv:6wRWBFYdt2anaKo+rGzCpEmZ3On83w/K
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2740-1-0x00000000023A0000-0x000000000342E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2740-1-0x00000000023A0000-0x000000000342E000-memory.dmp UPX behavioral1/memory/2740-2-0x0000000000400000-0x0000000000997000-memory.dmp UPX -
Processes:
resource yara_rule behavioral1/memory/2740-1-0x00000000023A0000-0x000000000342E000-memory.dmp upx -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2024-03-31_541795bc71cff09d3743baf59c2baf14_icedid.exepid process 2740 2024-03-31_541795bc71cff09d3743baf59c2baf14_icedid.exe 2740 2024-03-31_541795bc71cff09d3743baf59c2baf14_icedid.exe