Analysis
-
max time kernel
62s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 21:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-19_dcdc5658c11b9103a4786a35b7459f0e_icedid.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
General
-
Target
2024-04-19_dcdc5658c11b9103a4786a35b7459f0e_icedid.exe
-
Size
1.5MB
-
MD5
dcdc5658c11b9103a4786a35b7459f0e
-
SHA1
911c5f2ff1096b7fe3d1f3060bdffd801a777e29
-
SHA256
d87ae762b88946480a52feb99559d8195af163efcbcd605e0f05c43a4892fb07
-
SHA512
acc3099b2a108996acc0988fe5b20414f41a6b82f789e87c589d20f32226a2f0e93f53c4a8a3229a9fd1756e71c3cdeb577c35f3309a59a9555129e8f7b2eb54
-
SSDEEP
24576:9d8fS1xamM7uH3KHSEmoK+MtENLMieNmYvXE:9GfUamM7uH3KH7moK+MtENLd4mIXE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1428 2D67.tmp -
Loads dropped DLL 2 IoCs
pid Process 2868 2024-04-19_dcdc5658c11b9103a4786a35b7459f0e_icedid.exe 2868 2024-04-19_dcdc5658c11b9103a4786a35b7459f0e_icedid.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2024-04-19_dcdc5658c11b9103a4786a35b7459f0e_icedid.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\expsrv.dll 2D67.tmp File created C:\Windows\SysWOW64\msjter40.dll 2D67.tmp File created C:\Windows\SysWOW64\rdvgumd32.dll 2D67.tmp File created C:\Windows\SysWOW64\ir32_32.dll 2D67.tmp File created C:\Windows\SysWOW64\msrepl40.dll 2D67.tmp File created C:\Windows\SysWOW64\msvbvm60.dll 2D67.tmp File opened for modification C:\Windows\SysWOW64\atl110.dll 2D67.tmp File created C:\Windows\SysWOW64\crtdll.dll 2D67.tmp File created C:\Windows\SysWOW64\dpwsockx.dll 2D67.tmp File opened for modification C:\Windows\SysWOW64\mfc100.dll 2D67.tmp File opened for modification C:\Windows\SysWOW64\mfc100u.dll 2D67.tmp File created C:\Windows\SysWOW64\msexcl40.dll 2D67.tmp File created C:\Windows\SysWOW64\mswdat10.dll 2D67.tmp File created C:\Windows\SysWOW64\sqlunirl.dll 2D67.tmp File opened for modification C:\Windows\SysWOW64\concrt140.dll 2D67.tmp File opened for modification C:\Windows\SysWOW64\mfc120.dll 2D67.tmp File opened for modification C:\Windows\SysWOW64\MSCOMCTL.OCX 2D67.tmp File created C:\Windows\SysWOW64\msjtes40.dll 2D67.tmp File created C:\Windows\SysWOW64\msvcrt20.dll 2D67.tmp File created C:\Windows\SysWOW64\msxbde40.dll 2D67.tmp File created C:\Windows\SysWOW64\odbcjt32.dll 2D67.tmp File created C:\Windows\SysWOW64\dplaysvr.exe 2D67.tmp File created C:\Windows\SysWOW64\ir50_32.dll 2D67.tmp File created C:\Windows\SysWOW64\msrd3x40.dll 2D67.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdva.dll 2D67.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igdumd32.dll 2D67.tmp File opened for modification C:\Windows\SysWOW64\mfc120u.dll 2D67.tmp File created C:\Windows\SysWOW64\msltus40.dll 2D67.tmp File created C:\Windows\SysWOW64\olecli32.dll 2D67.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atidxx32.dll 2D67.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdag.dll 2D67.tmp File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2D67.tmp File opened for modification C:\Windows\SysWOW64\mfc140u.dll 2D67.tmp File created C:\Windows\SysWOW64\mfc40.dll 2D67.tmp File created C:\Windows\SysWOW64\msexch40.dll 2D67.tmp File opened for modification C:\Windows\SysWOW64\msvcr100.dll 2D67.tmp File opened for modification C:\Windows\SysWOW64\msvcr110.dll 2D67.tmp File created C:\Windows\SysWOW64\regedit.exe 2D67.tmp File created C:\Windows\SysWOW64\FXSXP32.dll 2D67.tmp File opened for modification C:\Windows\SysWOW64\mfc110u.dll 2D67.tmp File created C:\Windows\SysWOW64\msjet40.dll 2D67.tmp File created C:\Windows\SysWOW64\mswstr10.dll 2D67.tmp File opened for modification C:\Windows\SysWOW64\atl100.dll 2D67.tmp File created C:\Windows\SysWOW64\setupSNK.exe 2D67.tmp File opened for modification C:\Windows\SysWOW64\VBAME.DLL 2D67.tmp File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\MediaPlayer-DLMigPlugin.dll 2D67.tmp File created C:\Windows\SysWOW64\iac25_32.ax 2D67.tmp File opened for modification C:\Windows\SysWOW64\msvcr120.dll 2D67.tmp File created C:\Windows\SysWOW64\migration\MediaPlayer-DLMigPlugin.dll 2D67.tmp File created C:\Windows\SysWOW64\d3dim.dll 2D67.tmp File opened for modification C:\Windows\SysWOW64\mfc140.dll 2D67.tmp File created C:\Windows\SysWOW64\mstext40.dll 2D67.tmp File opened for modification C:\Windows\SysWOW64\vccorlib120.dll 2D67.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igd10umd32.dll 2D67.tmp File created C:\Windows\SysWOW64\InstallShield\setup.exe 2D67.tmp File created C:\Windows\SysWOW64\mspbde40.dll 2D67.tmp File created C:\Windows\SysWOW64\d3d8.dll 2D67.tmp File opened for modification C:\Windows\SysWOW64\FM20.DLL 2D67.tmp File created C:\Windows\SysWOW64\msorcl32.dll 2D67.tmp File created C:\Windows\SysWOW64\audiodev.dll 2D67.tmp File created C:\Windows\SysWOW64\d3dim700.dll 2D67.tmp File created C:\Windows\SysWOW64\d3dxof.dll 2D67.tmp File created C:\Windows\SysWOW64\dplayx.dll 2D67.tmp File created C:\Windows\SysWOW64\ivfsrc.ax 2D67.tmp -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1STAR.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCDDS.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\PAB.SAM 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7EN.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdate.dll 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAME.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONWordAddin.dll 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\FeedSync.dll 2D67.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeLinguistic.dll 2D67.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe 2D67.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Filters\odffilt.dll 2D67.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEREP.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msolui100.dll 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE 2D67.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VC\msdia100.dll 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE 2D67.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FPLACE.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE 2D67.tmp File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\xmlrwbin.dll 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ENVELOPE.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OISAPP.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PTXT9.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\MSGR3ES.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEOLEDB.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\RICHED20.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VC\msdia90.dll 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmgdsrv.dll 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordcnv.dll 2D67.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll 2D67.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\EScript.api 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPOLK.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MAPIPH.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDCAT.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\THOCRAPI.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.dll 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNoteSyncPC.dll 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLFLTR.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\OUTLVBA.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLJRNL.FAE 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLNOTE.FAE 2D67.tmp File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EMSMDB32.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api 2D67.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GKExcel.dll 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSODCW.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OMSMAIN.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7ES.DLL 2D67.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXSLE.dll 2D67.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEXBE.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OFFXML.DLL 2D67.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PSTPRX32.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VVIEWDWG.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup 2024-04-19_dcdc5658c11b9103a4786a35b7459f0e_icedid.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\ANALYS32.XLL 2D67.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\logsession.dll 2D67.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCL.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPWEC.DLL 2D67.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AUTHZAX.DLL 2D67.tmp -
Drops file in Windows directory 54 IoCs
description ioc Process File created C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll 2D67.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0000000010\9.0.0\ul_msvcr80.dll.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\sqmapi.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\MmcAspExt.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll 2D67.tmp File created C:\Windows\winsxs\amd64_igdlh.inf_31bf3856ad364e35_6.1.7600.16385_none_f3e7064ea3c09a9a\igdumd32.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.EnterpriseServices.Thunk.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\webengine4.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\FileTracker.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordbi.dll 2D67.tmp File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\wpfgfx_x86.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SOS.dll 2D67.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100u_x86 2D67.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_msvcr100_x86 2D67.tmp File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\system_data_dll_x86 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe 2D67.tmp File created C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfdll.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe 2D67.tmp File created C:\Windows\winsxs\amd64_atiilhag.inf_31bf3856ad364e35_6.1.7601.17514_none_03c46b205be81dfd\atidxx32.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationHost_v0400.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsecimpl.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll 2D67.tmp File created C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\wpfgfx_v0300.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AdoNetDiag.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\PerfCounter.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.OracleClient.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupEngine.dll 2D67.tmp File created C:\Windows\winsxs\amd64_atiilhag.inf_31bf3856ad364e35_6.1.7601.17514_none_03c46b205be81dfd\atiumdag.dll 2D67.tmp File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\system_data_dll_gac_x86 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\CORPerfMonExt.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualBasic.Activities.Compiler.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.dll 2D67.tmp File created C:\Windows\winsxs\amd64_atiilhag.inf_31bf3856ad364e35_6.1.7601.17514_none_03c46b205be81dfd\amdpcom32.dll 2D67.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_atl100_x86 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtilLib.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\alink.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll 2D67.tmp File created C:\Windows\winsxs\amd64_atiilhag.inf_31bf3856ad364e35_6.1.7601.17514_none_03c46b205be81dfd\atiumdva.dll 2D67.tmp File created C:\Windows\winsxs\amd64_igdlh.inf_31bf3856ad364e35_6.1.7600.16385_none_f3e7064ea3c09a9a\igd10umd32.dll 2D67.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100_x86 2D67.tmp File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PresentationHostDLL_X86.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 2D67.tmp File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUi.dll 2D67.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2868 2024-04-19_dcdc5658c11b9103a4786a35b7459f0e_icedid.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2868 wrote to memory of 1428 2868 2024-04-19_dcdc5658c11b9103a4786a35b7459f0e_icedid.exe 28 PID 2868 wrote to memory of 1428 2868 2024-04-19_dcdc5658c11b9103a4786a35b7459f0e_icedid.exe 28 PID 2868 wrote to memory of 1428 2868 2024-04-19_dcdc5658c11b9103a4786a35b7459f0e_icedid.exe 28 PID 2868 wrote to memory of 1428 2868 2024-04-19_dcdc5658c11b9103a4786a35b7459f0e_icedid.exe 28 PID 2868 wrote to memory of 488 2868 2024-04-19_dcdc5658c11b9103a4786a35b7459f0e_icedid.exe 29 PID 2868 wrote to memory of 488 2868 2024-04-19_dcdc5658c11b9103a4786a35b7459f0e_icedid.exe 29 PID 2868 wrote to memory of 488 2868 2024-04-19_dcdc5658c11b9103a4786a35b7459f0e_icedid.exe 29 PID 2868 wrote to memory of 488 2868 2024-04-19_dcdc5658c11b9103a4786a35b7459f0e_icedid.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_dcdc5658c11b9103a4786a35b7459f0e_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_dcdc5658c11b9103a4786a35b7459f0e_icedid.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\2D67.tmpC:\Users\Admin\AppData\Local\Temp\2D67.tmp2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1428
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"2⤵PID:488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666
-
Filesize
848B
MD5fa41a81574be9166fbedf550e6ce15b2
SHA14e42c4661c43df3aaba522ed05bd0207800d8f54
SHA2560d522e0a45405699ad32f8388fb3158964ec901da6d52ae5878916c08ca3a61e
SHA512a9ace68af0f55f8c3575c2876e0de2f7fd3184a57f95688da4ee84e559058e789af2299c01e801ee84ade766c7bd4db32f8890543e68ef8ee6bdf50e6332d4af
-
Filesize
251KB
MD5864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA256b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
SHA512ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09