Static task
static1
Behavioral task
behavioral1
Sample
2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid
-
Size
3.3MB
-
MD5
0f3185cfacdee33bc381c0cdd92c7972
-
SHA1
9d487fb0e2498a3cdef7a71a888d58518b0f11ed
-
SHA256
93b0bda1c86aacbf94300e66206d104cc1a7df70ec71bc217d63c1ab6a3c9c19
-
SHA512
77409ffd5622211c18baf76869bc1262e7bf1d4b9d30b02ccb755ef6eaf813b521d6f3a503b3c930e79532b2ae0c2f2bb2eb0f87c57d4ba2741daccff95aa55f
-
SSDEEP
98304:CmJi+eglbtDVG4exFK/USjlOc4KgDE62KFjI:ClIbtAulO2gD2KFjI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid
Files
-
2024-04-16_0f3185cfacdee33bc381c0cdd92c7972_icedid.exe windows:4 windows x86 arch:x86
ca693519786fae7cdeb8d7cc3391106b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateProcessA
SetFileAttributesA
CopyFileA
Sleep
CloseHandle
GetFileSize
CreateFileA
GetWindowsDirectoryA
GetCommandLineA
WriteFile
DeleteFileA
GetExitCodeProcess
WaitForSingleObject
SetFilePointer
CreateMutexA
FindClose
FindNextFileA
FindFirstFileA
PeekNamedPipe
GetStartupInfoA
CreatePipe
GetModuleHandleA
GetLastError
GetLogicalDriveStringsA
ReadFile
GetDriveTypeA
user32
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
LoadAcceleratorsA
PostQuitMessage
MessageBoxA
BeginPaint
EndPaint
DefWindowProcA
wsprintfA
DestroyWindow
CreateWindowExA
LoadIconA
LoadCursorA
RegisterClassExA
LoadStringA
advapi32
RegCloseKey
RegOpenKeyExA
RegSetValueExA
shell32
ShellExecuteA
msvcrt
_CxxThrowException
_endthread
fclose
fwrite
fseek
fopen
fread
__dllonexit
_onexit
??1type_info@@UAE@XZ
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
??2@YAPAXI@Z
__p__fmode
__set_app_type
_except_handler3
_controlfp
__CxxFrameHandler
memmove
exit
_beginthread
??3@YAXPAX@Z
rename
__p__commode
msvcp60
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?_Xlen@std@@YAXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
ws2_32
htons
inet_addr
socket
inet_ntoa
gethostbyname
WSAStartup
closesocket
recv
send
connect
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE