C:\os4k_devel\xie\vs2017\win_sources_V10\XieClient\Release\Xie.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-15_49e13a0b651a9a15716b45b4baed2887_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-15_49e13a0b651a9a15716b45b4baed2887_icedid.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-15_49e13a0b651a9a15716b45b4baed2887_icedid
-
Size
3.3MB
-
MD5
49e13a0b651a9a15716b45b4baed2887
-
SHA1
2f1800fe9bca0433ad4747c2045c0546c51ff040
-
SHA256
cb809dcfbbee8465cc58c7152e2770e423fd1401ea2bef7d2303dd54697aa49c
-
SHA512
92720ca59f37348782f7812bb04283fc9ec1cb15c42059f7a9e255b655e53a29357a50d1efb5416608e005435c2d893bc9101c548f16f276230dffc0fb5f6261
-
SSDEEP
98304:GwAh9UY15NSazHhABVtJyHYlEbWgylkI6E:GB0YHJuntRgylkQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-15_49e13a0b651a9a15716b45b4baed2887_icedid
Files
-
2024-04-15_49e13a0b651a9a15716b45b4baed2887_icedid.exe windows:6 windows x86 arch:x86
81e29cffd778c1c5bc5c804f4b845ea4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
xieapi
??0XIECommunication@@QAE@XZ
?setKeyAttr@XIEQueryInstance@@QAEHPAD0@Z
?selAll@XIEQueryInstance@@QAEHXZ
?getObjectInfo@XIEdbInstance@@QAEHPADH@Z
?clearAll@XIECreateInstance@@UAEXXZ
?setAdditionalSql@XIEModifyInstance@@QAEHPAD@Z
??1XIEModifyInstance@@QAE@XZ
?setAdditionalSql@XIEDeleteInstance@@QAEHPAD@Z
??1XIEDeleteInstance@@QAE@XZ
??1XIEdbInstance@@IAE@XZ
??1XIEListe@@QAE@XZ
?getRecord@XIEQueryInstance@@QAEHPADHD@Z
?fetchRecord@XIEQueryInstance@@QAEHXZ
?query@XIEQueryInstance@@QAEHXZ
?setOrderAttr@XIEQueryInstance@@QAEHPAD@Z
?setAdditionalSql@XIEQueryInstance@@QAEHPADH@Z
?selAttr@XIEQueryInstance@@QAEHPAD@Z
??1XIEQueryInstance@@QAE@XZ
??0XIEQueryInstance@@QAE@W4DBObjType@@PAVXIECommunication@@@Z
?create@XIECreateInstance@@QAEHPAD@Z
?setAttr@XIECreateInstance@@QAEHPAD0@Z
??0XIECreateInstance@@QAE@W4DBObjType@@PAVXIECommunication@@@Z
?modify@XIEModifyInstance@@QAEHPAD@Z
?setKeyAttr@XIEModifyInstance@@QAEHPAD0@Z
?updAttr@XIEModifyInstance@@QAEHPAD00@Z
??0XIEModifyInstance@@QAE@W4DBObjType@@PAVXIECommunication@@@Z
?deleteRecord@XIEDeleteInstance@@QAEHPAD@Z
?setKeyAttr@XIEDeleteInstance@@QAEHPAD0@Z
??0XIEDeleteInstance@@QAE@W4DBObjType@@PAVXIECommunication@@@Z
?getErrorMessage@XIEdbInstance@@QAEHPADH@Z
?getObjectNames@XIECommunication@@QAEHPADH@Z
?closeServer@XIECommunication@@QAEXXZ
?openServer@XIECommunication@@QAEHPAD0H0W4SEC_mode@@@Z
??1XIECommunication@@QAE@XZ
?objectNameToId@XIECommunication@@QAE?AW4DBObjType@@PAD@Z
kernel32
GetACP
FindResourceExW
GetWindowsDirectoryA
VerSetConditionMask
VerifyVersionInfoA
GetTempPathA
GetProfileIntA
SearchPathA
Sleep
LocalLock
LocalUnlock
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetSystemDefaultUILanguage
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetLocaleInfoW
GetCurrentDirectoryA
GetAtomNameA
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
GetCPInfo
InitializeCriticalSection
SystemTimeToTzSpecificLocalTime
SetFileAttributesA
LocalFileTimeToFileTime
GetFileSizeEx
GetFileAttributesExA
CreateFileW
FileTimeToLocalFileTime
VirtualProtect
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
FileTimeToSystemTime
GetUserDefaultLCID
SystemTimeToFileTime
ReplaceFileA
GetTempFileNameA
SetFileTime
GetFileTime
GetFileAttributesA
GetDiskFreeSpaceA
GetTickCount
GlobalGetAtomNameA
GlobalFindAtomA
FindResourceA
lstrcmpW
FreeResource
GetSystemDirectoryW
EncodePointer
GetStringTypeExA
GetThreadLocale
GetVolumeInformationA
MoveFileA
lstrcmpiA
GetOEMCP
SetErrorMode
GlobalFlags
TlsAlloc
OutputDebugStringW
FormatMessageW
SwitchToThread
CompareStringW
GetShortPathNameA
LoadLibraryA
GetCurrentProcess
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetFullPathNameA
GetFileSize
FlushFileBuffers
FindFirstFileA
FindClose
DeleteFileA
CreateFileA
LCMapStringW
GetStringTypeW
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetCurrentProcessId
GlobalAddAtomA
WritePrivateProfileStringA
GetUserDefaultUILanguage
GetPrivateProfileStringA
GetPrivateProfileIntA
CompareStringA
lstrcmpA
GlobalDeleteAtom
LoadLibraryW
LoadLibraryExW
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
FreeLibrary
GetVersionExA
GetCurrentThread
OutputDebugStringA
ResumeThread
SuspendThread
SetThreadPriority
GetCurrentThreadId
CreateEventA
WaitForSingleObject
SetEvent
CloseHandle
CopyFileA
FormatMessageA
MulDiv
LocalFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
SetLastError
ExpandEnvironmentStringsA
GetProcAddress
LoadLibraryExA
GetUserDefaultLangID
lstrcpyA
GetModuleFileNameA
CreateMutexA
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
lstrlenA
GetVersion
WideCharToMultiByte
MultiByteToWideChar
FindResourceW
SizeofResource
LockResource
LoadResource
GetCommandLineA
GetCommandLineW
ExitProcess
GetModuleHandleExW
GetSystemInfo
VirtualAlloc
VirtualQuery
CreateThread
ExitThread
FreeLibraryAndExitThread
SetStdHandle
GetFileType
HeapQueryInformation
QueryPerformanceFrequency
GetStdHandle
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetConsoleCtrlHandler
WriteConsoleW
TerminateProcess
user32
MonitorFromPoint
UpdateLayeredWindow
IsClipboardFormatAvailable
FrameRect
CopyIcon
SetCursorPos
DrawFrameControl
DrawEdge
DrawStateA
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
SetClassLongA
EnumDisplayMonitors
SetLayeredWindowAttributes
NotifyWinEvent
InvertRect
HideCaret
EnableScrollBar
MessageBeep
GetIconInfo
DrawIconEx
DrawFocusRect
GetNextDlgGroupItem
GetMenuDefaultItem
CreateMenu
CopyAcceleratorTableA
WindowFromDC
InSendMessage
GetTabbedTextExtentW
LockWindowUpdate
GetDCEx
UnionRect
LoadImageW
TrackMouseEvent
PostThreadMessageA
LoadMenuW
LoadAcceleratorsW
GetDialogBaseUnits
RealChildWindowFromPoint
CopyImage
GetSysColorBrush
SetWindowRgn
DrawIcon
DestroyCursor
FillRect
GetWindowDC
TabbedTextOutA
GrayStringA
DrawTextExA
DrawTextA
IsZoomed
SetParent
IsRectEmpty
GetSystemMenu
ReuseDDElParam
UnpackDDElParam
GetMenuBarInfo
LoadImageA
DestroyIcon
InsertMenuItemA
CreatePopupMenu
LoadMenuA
TranslateAcceleratorA
LoadAcceleratorsA
BringWindowToTop
LoadCursorW
ClientToScreen
SetCapture
IntersectRect
MapDialogRect
SystemParametersInfoA
InflateRect
GetMenuItemInfoA
DestroyMenu
MapVirtualKeyA
GetKeyNameTextA
SetRectEmpty
ReleaseDC
GetDC
WindowFromPoint
RegisterClipboardFormatA
IsWindow
SetTimer
WaitMessage
GetDesktopWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamA
IsDialogMessageA
SetWindowTextA
ScrollWindowEx
SendDlgItemMessageA
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextA
SetDlgItemTextA
GetDlgItemInt
SetDlgItemInt
ShowWindow
GetMonitorInfoA
MonitorFromWindow
WinHelpA
GetScrollInfo
SetScrollInfo
LoadIconW
LoadIconA
GetClassLongA
SetWindowLongA
PtInRect
EqualRect
MapWindowPoints
AdjustWindowRectEx
RemovePropA
GetPropA
SetPropA
ShowScrollBar
GetScrollRange
SetScrollRange
ScrollWindow
EndPaint
BeginPaint
GetForegroundWindow
SetActiveWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
DestroyWindow
IsChild
IsMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
CallWindowProcA
DefWindowProcA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
GetWindowTextLengthA
GetWindowTextA
GetScrollPos
SetScrollPos
SetFocus
UnhookWindowsHookEx
GetSystemMetrics
CharUpperA
GetLastActivePopup
GetWindowThreadProcessId
GetWindowLongA
MessageBoxA
IsWindowEnabled
ShowOwnedPopups
LoadBitmapW
SetMenuItemInfoA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetTabbedTextExtentA
GetWindowRgn
MonitorFromRect
SubtractRect
TranslateMDISysAccel
DefMDIChildProcA
DefFrameProcA
DrawMenuBar
EnumChildWindows
SendNotifyMessageA
GetUpdateRect
CharUpperBuffA
ModifyMenuA
GetDoubleClickTime
SetMenuDefaultItem
DestroyAcceleratorTable
CreateAcceleratorTableA
ToAsciiEx
GetKeyboardState
MapVirtualKeyExA
IsCharLowerA
GetKeyboardLayout
KillTimer
EnableMenuItem
CheckMenuItem
GetFocus
PostQuitMessage
CallNextHookEx
SetWindowsHookExA
ValidateRect
GetKeyState
GetActiveWindow
IsWindowVisible
GetMessageA
RemoveMenu
GetComboBoxInfo
InsertMenuA
GetMenuItemCount
GetMenuState
GetMenuStringA
SetRect
PeekMessageA
DispatchMessageA
TranslateMessage
UpdateWindow
OffsetRect
CopyRect
GetSysColor
GetAsyncKeyState
PostMessageA
LoadCursorA
SetCursor
InvalidateRect
GetCursorPos
GetClientRect
GetParent
DeleteMenu
AppendMenuA
GetMenuItemID
GetSubMenu
RedrawWindow
SendMessageA
FindWindowA
SetForegroundWindow
EnableWindow
IsIconic
OpenIcon
UnregisterClassA
GetWindow
GetTopWindow
GetClassNameA
ScreenToClient
GetWindowRect
GetDlgItem
MoveWindow
ReleaseCapture
gdi32
SetTextJustification
PlayMetaFileRecord
EnumMetaFile
PtVisible
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
StartDocA
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
ExtCreatePen
MoveToEx
TextOutA
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
GetViewportOrgEx
CreateEllipticRgn
Ellipse
CreateDIBSection
LPtoDP
EnumFontFamiliesExA
GetBkColor
GetROP2
GetBkMode
SetTextAlign
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextExtentPointA
GetTextExtentPoint32W
GetWindowOrgEx
GetTextFaceA
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
GetDIBits
SetPixel
StretchBlt
SetDIBColorTable
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
CloseMetaFile
CreateMetaFileA
DeleteMetaFile
GetRgnBox
OffsetRgn
GetCurrentObject
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
PlayMetaFile
OffsetClipRgn
LineTo
SetTextCharacterExtra
SetStretchBltMode
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetGraphicsMode
SetMapperFlags
SetBkMode
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
GetNearestColor
SetTextColor
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetCurrentPositionEx
GetClipRgn
GetClipBox
ExcludeClipRect
Escape
CreateSolidBrush
CreatePen
CreateHatchBrush
CreateDIBPatternBrushPt
StretchDIBits
GetCharWidthA
CreateFontA
GetTextMetricsA
SelectObject
SetRectRgn
GetMapMode
DeleteObject
CreateRectRgn
CreatePatternBrush
CombineRgn
DeleteDC
ExtTextOutA
BitBlt
PatBlt
CreateRectRgnIndirect
CreateFontIndirectA
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectA
SetBkColor
CreateBitmap
CreateDCA
CopyMetaFileA
DPtoLP
Rectangle
GetTextExtentPoint32A
GetDeviceCaps
GetTextColor
RectVisible
msimg32
TransparentBlt
AlphaBlend
winspool.drv
OpenPrinterA
ClosePrinter
DocumentPropertiesA
GetJobA
advapi32
RegEnumKeyExA
RegEnumValueA
GetFileSecurityA
SetFileSecurityA
RegOpenKeyExW
RegQueryValueA
RegEnumKeyA
RegDeleteValueA
RegDeleteKeyA
RegSetValueA
GetUserNameA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
DragAcceptFiles
SHGetFileInfoA
DragQueryFileA
DragFinish
SHAddToRecentDocs
ShellExecuteExA
SHAppBarMessage
ShellExecuteA
SHGetSpecialFolderLocation
ExtractIconA
SHGetMalloc
shlwapi
PathRemoveExtensionA
PathFindExtensionA
PathStripToRootA
PathRemoveFileSpecW
StrFormatKBSizeA
PathIsUNCA
PathFindFileNameA
uxtheme
OpenThemeData
GetWindowTheme
DrawThemeBackground
IsThemeBackgroundPartiallyTransparent
DrawThemeParentBackground
DrawThemeText
GetCurrentThemeName
GetThemeColor
GetThemeSysColor
CloseThemeData
GetThemePartSize
IsAppThemed
ole32
CreateBindCtx
CoTreatAsClass
WriteClassStg
OleCreateMenuDescriptor
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID
CoCreateInstance
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CLSIDFromProgID
OleRun
OleQueryCreateFromData
OleQueryLinkFromData
OleSetMenuDescriptor
RevokeDragDrop
RegisterDragDrop
WriteFmtUserTypeStg
OleGetIconOfClass
OleLockRunning
OleSetContainedObject
OleSave
OleGetClipboard
OleLoad
OleCreateFromFile
OleCreateLinkToFile
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
OleCreate
GetHGlobalFromILockBytes
ReadFmtUserTypeStg
CoGetMalloc
OleIsRunning
GetRunningObjectTable
CoLockObjectExternal
CreateOleAdviseHolder
OleSaveToStream
OleDuplicateData
ReleaseStgMedium
OleRegGetUserType
SetConvertStg
CoUninitialize
CoCreateGuid
CoInitialize
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
PropVariantCopy
CoInitializeEx
StringFromGUID2
CoDisconnectObject
CLSIDFromString
CoGetClassObject
CoRegisterClassObject
CoRevokeClassObject
OleSetClipboard
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
CreateStreamOnHGlobal
OleRegGetMiscStatus
DoDragDrop
OleRegEnumVerbs
CreateItemMoniker
CreateGenericComposite
CreateDataAdviseHolder
WriteClassStm
StgCreateDocfileOnILockBytes
CreateFileMoniker
CreateILockBytesOnHGlobal
StgIsStorageFile
StgOpenStorageOnILockBytes
StgOpenStorage
StgCreateDocfile
ReadClassStg
oleaut32
SysAllocString
VarDecFromStr
VarBstrFromDec
VarBstrFromDate
VarBstrFromCy
VarCyFromStr
VariantCopy
SafeArrayPtrOfIndex
SafeArrayCopy
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayRedim
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SafeArrayAllocData
SafeArrayAllocDescriptor
SysReAllocStringLen
SysStringLen
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
VarDateFromStr
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
SysFreeString
SafeArrayCreate
wsock32
WSASetLastError
WSAAsyncSelect
WSAStartup
gethostbyname
socket
sendto
select
recvfrom
recv
ntohs
inet_addr
ioctlsocket
htons
htonl
getsockname
getpeername
WSAGetLastError
connect
closesocket
bind
accept
WSACleanup
send
oledlg
ord8
oleacc
CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject
gdiplus
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipDrawImageRectI
imm32
ImmReleaseContext
ImmGetContext
ImmGetOpenStatus
winmm
PlaySoundA
Sections
.text Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 597KB - Virtual size: 597KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 37KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ