6a64be75ed360b0da3e16ed0c7ee779c14fcbfa07d7a3aad7ed5395f41933433

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-03_72d9a6aa74074021f0f33fa771189e9e_icedid.exe
Size 284KB
Sample240403-ycx15aba68
SHA256 6a64be75ed360b0da3e16ed0c7ee779c14fcbfa07d7a3aad7ed5395f41933433
MD5 72d9a6aa74074021f0f33fa771189e9e
SHA1 7b8ed81766967449674af7111f4515415ec878b3
SHA512 abc37d4a265b06c451f16da463bcdce7d2bd98c3da9c3bbe8f1a950dcb7393f007d50b8f83d8bf7ddfef64bd4d73e6d7c6d347b6d562339387909cd1dc980d3a
SSDEEP 6144:QlDx7mlcAZBcIdqkorDfoR/0C1fzDB9ePHSJ:QlDx7mlHZo7HoRv177ePH
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1960	sethome3171.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\system\sethome3171.exe	2024-04-03_72d9a6aa74074021f0f33fa771189e9e_icedid.exe
File opened for modification	\??\c:\windows\system\sethome3171.exe	2024-04-03_72d9a6aa74074021f0f33fa771189e9e_icedid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.baiduo.org/"	2024-04-03_72d9a6aa74074021f0f33fa771189e9e_icedid.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4928	2024-04-03_72d9a6aa74074021f0f33fa771189e9e_icedid.exe
4928	2024-04-03_72d9a6aa74074021f0f33fa771189e9e_icedid.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4928	2024-04-03_72d9a6aa74074021f0f33fa771189e9e_icedid.exe
4928	2024-04-03_72d9a6aa74074021f0f33fa771189e9e_icedid.exe
4928	2024-04-03_72d9a6aa74074021f0f33fa771189e9e_icedid.exe
4928	2024-04-03_72d9a6aa74074021f0f33fa771189e9e_icedid.exe
1960	sethome3171.exe
1960	sethome3171.exe
1960	sethome3171.exe
1960	sethome3171.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 1960	4928	2024-04-03_72d9a6aa74074021f0f33fa771189e9e_icedid.exe	108
PID 4928 wrote to memory of 1960	4928	2024-04-03_72d9a6aa74074021f0f33fa771189e9e_icedid.exe	108
PID 4928 wrote to memory of 1960	4928	2024-04-03_72d9a6aa74074021f0f33fa771189e9e_icedid.exe	108

C:\Users\Admin\AppData\Local\Temp\2024-04-03_72d9a6aa74074021f0f33fa771189e9e_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-03_72d9a6aa74074021f0f33fa771189e9e_icedid.exe"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928
- \??\c:\windows\system\sethome3171.exe
  c:\windows\system\sethome3171.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2712 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
1⤵
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Internet Explorer.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk
Size 1KB
SHA256 c32a2d78ec834121272e0bd40354ca7ccfbb43c3f85efd04f82f4537c951f2ce
MD5 49eb39218e96625f6046a8f52f94805b
SHA1 01a4d501a4defcdca7b147fabac6bf7e05debe0a
SHA512 fb6cf87c2657380d328901f3b5c75ae7f3d3ce94edf2970cfe29508aff299cf8c17dcace97d3beed4a57e368d8035312f9705274ea5925fad91b68e9df68432f
MD5 SHA1 SHA512

Submit Download

abc.lnk

Path C:\Users\abc.lnk
Size 1KB
SHA256 2f80780ade8ea56a2a6792aac2d30f7963c31218b1b04bce2239a4f7fe772cd1
MD5 90130905b5ffa03997a77bc17e0fb87d
SHA1 5e677cdeee59d9fb6747fec00ff3304788dc8997
SHA512 20c1db4f89e4892f21730598227aeefe673e369a120f52be5c7ece5808e7687e7725b78e0fe0313166b8cbc86fad4176d02e2de540f2be1a3cf37ce48f285b9f
MD5 SHA1 SHA512

Submit Download

sethome3171.exe

Path C:\Windows\System\sethome3171.exe
Size 284KB
SHA256 8bdfc3f48e55c5c083fdbab99765f9ad75a5fd4bf73ef2332ed6e26d6a657f1e
MD5 92310edea9154121d25c9549a381969b
SHA1 343d2efa8653b25a7ff6339611565c764ac4cbc3
SHA512 927d998205a4a8a470f3b5fd574b5739e7558e6eab247a75c40ed9085b191ffeca33742572ff9a30686c946bb957c4b7445fcc1992bbdc0409bd0257ad93a8d8
SSDEEP 6144:6lDx7mlcAZBcIdqkorDfoR/0C1fzDB9ePHSJ:6lDx7mlHZo7HoRv177ePH
MD5 SHA1 SHA512 SSDEEP

Submit Download