93b0bda1c86aacbf94300e66206d104cc1a7df70ec71bc217d63c1ab6a3c9c19

General

Target

2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe
Size

3.3MB
MD5

0f3185cfacdee33bc381c0cdd92c7972
SHA1

9d487fb0e2498a3cdef7a71a888d58518b0f11ed
SHA256

93b0bda1c86aacbf94300e66206d104cc1a7df70ec71bc217d63c1ab6a3c9c19
SHA512

77409ffd5622211c18baf76869bc1262e7bf1d4b9d30b02ccb755ef6eaf813b521d6f3a503b3c930e79532b2ae0c2f2bb2eb0f87c57d4ba2741daccff95aa55f
SSDEEP

98304:CmJi+eglbtDVG4exFK/USjlOc4KgDE62KFjI:ClIbtAulO2gD2KFjI

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\svchost.exe"	2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe

Executes dropped EXE 1 IoCs

pid	Process
2640	2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe

Loads dropped DLL 6 IoCs

pid	Process
2932	2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.exe	2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe
File opened for modification	C:\Windows\conime.exe	2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe
File created	C:\Windows\svchost.exe	2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2292	2640	WerFault.exe	28

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2932	2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2640	2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe
2640	2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2640	2932	2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe	28
PID 2932 wrote to memory of 2640	2932	2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe	28
PID 2932 wrote to memory of 2640	2932	2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe	28
PID 2932 wrote to memory of 2640	2932	2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe	28
PID 2640 wrote to memory of 2292	2640	2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe	29
PID 2640 wrote to memory of 2292	2640	2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe	29
PID 2640 wrote to memory of 2292	2640	2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe	29
PID 2640 wrote to memory of 2292	2640	2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 248
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe

Filesize
3.3MB

MD5
16b72dbdbd99ce0888f52ad3e61f69ff

SHA1
0902e6a2de2eed4e0f18a4a9961ad1973b886181

SHA256
90e8239cb1d773e4df1910b5b5aa686ed7653c8a3e900f5f9b45a6ceca76f703

SHA512
6dddf33fe3b276184c58ba4b1480435dbd32bc4d55be0348ddae06e856c7641cb49b46ee38cca50e628963618672e5e3850014dca820b983539a574fef2ec2d6

Download Submit
C:\Windows\conime.exe

Filesize
35KB

MD5
a503352f509804e37e2f6904a2374e48

SHA1
77513a2e0a8e6874d5c4259689407001281e85af

SHA256
5a1ae64e786ccb8e4d8fa9827db76f5bdfe7fe0c402b4367a1dfb7df296f48ce

SHA512
03f54e4297aad903750c53613d7db56818f64bf344c9e528aa8cf74c076b44ffbf9e9538e659d413c5d80dbffc8963e550b483c8f8cd3682b3d4c4e5c933d00a

Download Submit
memory/2932-0-0x0000000000400000-0x0000000000408E00-memory.dmp

Filesize
35KB

Download
memory/2932-1-0x0000000000400000-0x0000000000408E00-memory.dmp

Filesize
35KB

Download
memory/2932-20-0x0000000000400000-0x0000000000408E00-memory.dmp

Filesize
35KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads