51f1373875185dcf5360487c525f57e44fd3b1ddb82baba99a2e3caed25a52f5

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 20:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-16_7e677c28195eb9bc30810cf927eedb06_icedid.exe
Size

1.4MB
MD5

7e677c28195eb9bc30810cf927eedb06
SHA1

1c024aa28e171bde9a26454aae2fe5ea79b3fb5e
SHA256

51f1373875185dcf5360487c525f57e44fd3b1ddb82baba99a2e3caed25a52f5
SHA512

90c7b9ba113a1c5c9a977c3a90c70abe41bf7aa760772cd370dc41b4fa86d516aa8b0e003bb37ef8ee75f7581b6382be905682dd3d49118a1f59dfa91aa889a2
SSDEEP

24576:0qLMGoUoB6L69VdUgKyM3iHjatIiM9oOFL:0qLMz6L69VdUgDMyHja8n

Score

7^/10

evasion spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2524	1832.tmp

Loads dropped DLL 2 IoCs

pid	Process
2200	2024-04-16_7e677c28195eb9bc30810cf927eedb06_icedid.exe
2200	2024-04-16_7e677c28195eb9bc30810cf927eedb06_icedid.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2024-04-16_7e677c28195eb9bc30810cf927eedb06_icedid.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msexch40.dll	1832.tmp
File created	C:\Windows\SysWOW64\setupSNK.exe	1832.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvwgf2um.dll	1832.tmp
File opened for modification	C:\Windows\SysWOW64\atl100.dll	1832.tmp
File created	C:\Windows\SysWOW64\msrepl40.dll	1832.tmp
File opened for modification	C:\Windows\SysWOW64\msvcr120_clr0400.dll	1832.tmp
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\MediaPlayer-DLMigPlugin.dll	1832.tmp
File created	C:\Windows\SysWOW64\olecli32.dll	1832.tmp
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	1832.tmp
File created	C:\Windows\SysWOW64\dmscript.dll	1832.tmp
File created	C:\Windows\SysWOW64\explorer.exe	1832.tmp
File created	C:\Windows\SysWOW64\msjet40.dll	1832.tmp
File created	C:\Windows\SysWOW64\msltus40.dll	1832.tmp
File created	C:\Windows\SysWOW64\msvcrt20.dll	1832.tmp
File created	C:\Windows\SysWOW64\ir32_32.dll	1832.tmp
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	1832.tmp
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	1832.tmp
File created	C:\Windows\SysWOW64\msexcl40.dll	1832.tmp
File created	C:\Windows\SysWOW64\d3dxof.dll	1832.tmp
File created	C:\Windows\SysWOW64\dpwsockx.dll	1832.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\amdpcom32.dll	1832.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igd10umd32.dll	1832.tmp
File created	C:\Windows\SysWOW64\d3dim700.dll	1832.tmp
File opened for modification	C:\Windows\SysWOW64\mfc100.dll	1832.tmp
File opened for modification	C:\Windows\SysWOW64\mfc120u.dll	1832.tmp
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	1832.tmp
File created	C:\Windows\SysWOW64\InstallShield\setup.exe	1832.tmp
File created	C:\Windows\SysWOW64\InstallShield\_isdel.exe	1832.tmp
File created	C:\Windows\SysWOW64\msvbvm60.dll	1832.tmp
File created	C:\Windows\SysWOW64\dplayx.dll	1832.tmp
File opened for modification	C:\Windows\SysWOW64\mfc100u.dll	1832.tmp
File opened for modification	C:\Windows\SysWOW64\mfc110.dll	1832.tmp
File created	C:\Windows\SysWOW64\mfc40u.dll	1832.tmp
File opened for modification	C:\Windows\SysWOW64\MSCOMCTL.OCX	1832.tmp
File created	C:\Windows\SysWOW64\msorcl32.dll	1832.tmp
File created	C:\Windows\SysWOW64\d3dim.dll	1832.tmp
File created	C:\Windows\SysWOW64\ivfsrc.ax	1832.tmp
File created	C:\Windows\SysWOW64\msjter40.dll	1832.tmp
File created	C:\Windows\SysWOW64\msjtes40.dll	1832.tmp
File created	C:\Windows\SysWOW64\msrd3x40.dll	1832.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atidxx32.dll	1832.tmp
File opened for modification	C:\Windows\SysWOW64\FM20.DLL	1832.tmp
File created	C:\Windows\SysWOW64\mfc40.dll	1832.tmp
File created	C:\Windows\SysWOW64\msrd2x40.dll	1832.tmp
File opened for modification	C:\Windows\SysWOW64\msvcr120.dll	1832.tmp
File created	C:\Windows\SysWOW64\sqlwoa.dll	1832.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdva.dll	1832.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdag.dll	1832.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvd3dum.dll	1832.tmp
File created	C:\Windows\SysWOW64\audiodev.dll	1832.tmp
File created	C:\Windows\SysWOW64\iac25_32.ax	1832.tmp
File created	C:\Windows\SysWOW64\ir41_32.ax	1832.tmp
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	1832.tmp
File created	C:\Windows\SysWOW64\mswdat10.dll	1832.tmp
File created	C:\Windows\SysWOW64\regedit.exe	1832.tmp
File created	C:\Windows\SysWOW64\crtdll.dll	1832.tmp
File created	C:\Windows\SysWOW64\expsrv.dll	1832.tmp
File opened for modification	C:\Windows\SysWOW64\mfc110u.dll	1832.tmp
File created	C:\Windows\SysWOW64\mswstr10.dll	1832.tmp
File created	C:\Windows\SysWOW64\ir50_32.dll	1832.tmp
File opened for modification	C:\Windows\SysWOW64\mfc120.dll	1832.tmp
File created	C:\Windows\SysWOW64\odbcjt32.dll	1832.tmp
File created	C:\Windows\SysWOW64\sqlunirl.dll	1832.tmp
File opened for modification	C:\Windows\SysWOW64\VBAME.DLL	1832.tmp

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll	1832.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPWEC.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\RM.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	2024-04-16_7e677c28195eb9bc30810cf927eedb06_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp	1832.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FPERSON.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IEAWSDC.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\FeedSync.dll	1832.tmp
File opened for modification	C:\Program Files (x86)\Common Files\DESIGNER\MSADDNDR.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCL.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLAPPT.FAE	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\Synchronization.dll	1832.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Csi.dll	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PTXT9.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DELIMWIN.FAE	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7FR.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe	1832.tmp
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\vdk150.dll	1832.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACERCLR.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DESKSAM.SAM	1832.tmp
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll	1832.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\MOFL.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONBttnPPT.dll	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE	1832.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXEV.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CDLMSO.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\mset7tkjp.dll	1832.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\MSOSV.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSODCW.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7EN.DLL	1832.tmp
File opened for modification	C:\Program Files\7-Zip\7z.sfx	1832.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll	1832.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\STSCOPY.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1033\MSGR3EN.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\NPSWF32.dll	1832.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FBIBLIO.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\RECALL.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSAutogen.dll	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OLMAPI32.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OUTLMIME.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE	1832.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Portal\PortalConnectCore.dll	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ENVELOPE.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLTASK.FAE	1832.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AiodLite.dll	1832.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeXMP.dll	1832.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api	1832.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\MSB1FREN.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\xmlrwbin.dll	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOHEVI.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ORG97.SAM	1832.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\sqlite.dll	1832.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api	1832.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\EMABLT32.DLL	1832.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE	1832.tmp
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll	1832.tmp

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\x86_microsoft-windows-m..nents-mdac-sqlunirl_31bf3856ad364e35_6.1.7600.16385_none_3bed0e7fdd8193ca\sqlunirl.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_6.1.7600.16385_none_5ae7f926deb5de01\rdrleakdiag.exe	1832.tmp
File created	C:\Windows\winsxs\Backup\x86_microsoft-windows-audio-mmecore-base_31bf3856ad364e35_6.1.7601.17514_none_b7e72625aff23492_winmm.dll_08d4f5e8	1832.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-t..pc-mathinputcontrol_31bf3856ad364e35_6.1.7600.16385_none_e8a704ebfa319de9\micaut.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-azman_31bf3856ad364e35_6.1.7601.17514_none_585e832110fb75a4\azroles.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-c..plus-admin-comadmin_31bf3856ad364e35_6.1.7600.16385_none_313785582054d3f3\comadmin.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_6.1.7601.17514_none_720e868d9b0b6a44\WerFault.exe	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-msmq-admin_31bf3856ad364e35_6.1.7601.17514_none_b9556b899bae7dc1\mqsnap.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-security-spp-pidgenx_31bf3856ad364e35_6.1.7600.16385_none_01492afa24f8db99\pidgenx.dll	1832.tmp
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupEngine.dll	1832.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_11.2.9600.16428_none_88216b07fe83d256\wininet.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-pdm_31bf3856ad364e35_8.0.7601.17514_none_0a379bcfbdcffb74\pdm.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_8.0.7600.16385_none_7f0c7a3c17077fce\iexpress.exe	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-m..onents-mdac-odbcbcp_31bf3856ad364e35_6.1.7600.16385_none_b0d14a16af76d049\odbcbcp.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-remotesp_31bf3856ad364e35_6.1.7600.16385_none_aefa4fc5b836c200\remotesp.tsp	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-upgrade_31bf3856ad364e35_6.1.7600.16385_none_54780cc7e444c076\WsUpgrade.dll	1832.tmp
File created	C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-directx-direct3d_31bf3856ad364e35_6.1.7600.16385_none_eb246466b6cc92e7\d3dim700.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-jsprofilercore_31bf3856ad364e35_8.0.7600.16385_none_253839ca09b4c8e4\JSProfilerCore.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-security-spp-clientext_31bf3856ad364e35_6.1.7600.16385_none_cc9d4bf812728aae\sppcext.dll	1832.tmp
File created	C:\Windows\winsxs\Backup\x86_microsoft-windows-crypt32-dll_31bf3856ad364e35_6.1.7601.17514_none_5d772bc73c15dfe5_crypt32.dll_9c3ccf73	1832.tmp
File created	C:\Windows\winsxs\Backup\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_6.1.7601.17514_none_227e1c01642654f4_wermgr.exe_d92a3b6c	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-m..ponents-mdac-sqlwoa_31bf3856ad364e35_6.1.7600.16385_none_19575e8bcec889b5\sqlwoa.dll	1832.tmp
File created	C:\Windows\winsxs\amd64_nv_lh.inf_31bf3856ad364e35_6.1.7600.16385_none_4a5c7d78e486512b\nvwgf2um.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-management-console_31bf3856ad364e35_6.1.7600.16385_none_0f49a133d6f5d42b\mmcshext.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-i..ersandsecurityzones_31bf3856ad364e35_8.0.7601.17514_none_d1a4c8feac0dfcdb\urlmon.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-downlevelmanifests_31bf3856ad364e35_6.1.7601.17514_none_04801f69e1dbd8e6\NlbMigPlugin.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-riched32_31bf3856ad364e35_6.1.7601.17514_none_9f081dc1e0ddbddb\riched20.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-wia-automation_31bf3856ad364e35_6.1.7600.16385_none_0548aa042531f668\wiaaut.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-xwizard-host-process_31bf3856ad364e35_6.1.7600.16385_none_58ca66f699d77ff1\xwizard.exe	1832.tmp
File created	C:\Windows\winsxs\x86_system.data.oracleclient_b77a5c561934e089_6.1.7601.17514_none_c79237cc99cb8865\System.Data.OracleClient.dll	1832.tmp
File created	C:\Windows\winsxs\wow64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.7601.17514_none_c519dbeb6e585715\winhttp.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-g..policy-admin-appmgr_31bf3856ad364e35_6.1.7601.17514_none_fcc0c5ed143b8eb0\appmgr.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_8.0.7601.17514_none_190fa02cb006154d\msfeedsbs.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-ieshims_31bf3856ad364e35_11.2.9600.16428_none_cdc5a77ff6e9c343\IEShims.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-cryptext-dll_31bf3856ad364e35_6.1.7600.16385_none_ff6918de770cb659\cryptext.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-management-console_31bf3856ad364e35_6.1.7600.16385_none_0f49a133d6f5d42b\cic.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\tracerpt.exe	1832.tmp
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\SOS.dll	1832.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3d8bb37f97ba22ff\sdbinst.exe	1832.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-drm_31bf3856ad364e35_6.1.7601.17514_none_d6a8cb040fcd3a85\msnetobj.dll	1832.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.1.7601.17514_none_32e02520f8081891\WsmWmiPl.dll	1832.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_atl100_x86	1832.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4a5d2c9ecd59afa7\dnscacheugc.exe	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-setup_31bf3856ad364e35_11.2.9600.16428_none_1f77d330a4790dae\inseng.dll	1832.tmp
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\PerfCounter.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-downlevelmanifests_31bf3856ad364e35_6.1.7601.17514_none_04801f69e1dbd8e6\WMIMigrationPlugin.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-object-picker_31bf3856ad364e35_6.1.7600.16385_none_0f6c30b96de81257\objsel.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-m..c-oracle-driver-dll_31bf3856ad364e35_6.1.7601.17514_none_6b16a37ea1353bb1\msorcl32.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-rpc-ping_31bf3856ad364e35_6.1.7600.16385_none_9d906433a20c1949\RpcPing.exe	1832.tmp
File created	C:\Windows\winsxs\Backup\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13_wininit.exe_7a527f28	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-a..dcredentialprovider_31bf3856ad364e35_6.1.7601.17514_none_44120ea520cf6a6d\SmartcardCredentialProvider.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-aclui_31bf3856ad364e35_6.1.7600.16385_none_54e0b44114fa502d\aclui.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-c..complus-runtime-qfe_31bf3856ad364e35_6.1.7600.16385_none_6b3984a4d9e2684a\catsrv.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-ratings_31bf3856ad364e35_8.0.7601.17514_none_e453ef7731ff4c4f\msrating.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-winrsplugins_31bf3856ad364e35_6.1.7600.16385_none_160ccc8a92fae520\winrshost.exe	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-osk_31bf3856ad364e35_6.1.7600.16385_none_aa93298fbb4246f2\osk.exe	1832.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-wmnetmgr_31bf3856ad364e35_6.1.7601.17514_none_afc0a5d809a22c4b\WMNetMgr.dll	1832.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-security-digest_31bf3856ad364e35_6.1.7600.16385_none_a116e710cac6dc6b\wdigest.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.1.7600.16385_none_0bfb8f2b539d4d43\AcSpecfc.dll	1832.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-diskmanagement_31bf3856ad364e35_6.1.7600.16385_none_016e0bdad110d4d1\dmdlgs.dll	1832.tmp
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe	1832.tmp
File created	C:\Windows\winsxs\Backup\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_6.1.7600.16385_none_2e9f92abd2ce43b6_hhsetup.dll_37c1de59	1832.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2200	2024-04-16_7e677c28195eb9bc30810cf927eedb06_icedid.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2524	2200	2024-04-16_7e677c28195eb9bc30810cf927eedb06_icedid.exe	28
PID 2200 wrote to memory of 2524	2200	2024-04-16_7e677c28195eb9bc30810cf927eedb06_icedid.exe	28
PID 2200 wrote to memory of 2524	2200	2024-04-16_7e677c28195eb9bc30810cf927eedb06_icedid.exe	28
PID 2200 wrote to memory of 2524	2200	2024-04-16_7e677c28195eb9bc30810cf927eedb06_icedid.exe	28
PID 2200 wrote to memory of 1028	2200	2024-04-16_7e677c28195eb9bc30810cf927eedb06_icedid.exe	29
PID 2200 wrote to memory of 1028	2200	2024-04-16_7e677c28195eb9bc30810cf927eedb06_icedid.exe	29
PID 2200 wrote to memory of 1028	2200	2024-04-16_7e677c28195eb9bc30810cf927eedb06_icedid.exe	29
PID 2200 wrote to memory of 1028	2200	2024-04-16_7e677c28195eb9bc30810cf927eedb06_icedid.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-04-16_7e677c28195eb9bc30810cf927eedb06_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-16_7e677c28195eb9bc30810cf927eedb06_icedid.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\1832.tmp
  C:\Users\Admin\AppData\Local\Temp\1832.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  PID:2524
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
  2⤵
  PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AdobeARM.log

Filesize
848B

MD5
cdc4736abd62dcc5296ff406195135a6

SHA1
dfe595f4dc2c809be46b99c38ed5884736b1d7d7

SHA256
c79895367eb529333a49d807c822e71391bd33d5d0dd56f9c6e3a601db517193

SHA512
66472a948b04e4aebc98e10515306ab5e0ec1ef92c104bdb24427a7d525275d830f9d9c4e0956c6e3848324add9f5361ea1dd0d5c7332cced8e101ecd6fb0c60

Download Submit
C:\Users\Admin\AppData\Local\Temp\ArmUI.ini

Filesize
251KB

MD5
864c22fb9a1c0670edf01c6ed3e4fbe4

SHA1
bf636f8baed998a1eb4531af9e833e6d3d8df129

SHA256
b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0

SHA512
ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09

Download Submit
\Users\Admin\AppData\Local\Temp\1832.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
memory/2200-0-0x00000000002D0000-0x0000000000314000-memory.dmp

Filesize
272KB

Download
memory/2200-1-0x00000000002D0000-0x0000000000314000-memory.dmp

Filesize
272KB

Download