Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 14:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe
Resource
win7-20240220-en
General
-
Target
2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe
-
Size
1.5MB
-
MD5
ba42ce69b31605095ac77ad2c7a0005f
-
SHA1
9f734fbbb72e2fccd7922a130d2a750813c7b0f3
-
SHA256
3de0d11224caea50c850cc01ac7b6c504c5497d36122280a957a825533b4985c
-
SHA512
2f62ef39c93687d139e2329d51b68072701ff306cfdccfe9d5f07177cafe3a23df0c6f89abc43d635c0f4141c34cb1ff70ec5292025f647f1635e1151361e2c3
-
SSDEEP
24576:YJrS+cYxf3X29pYfdD9QDC0YLwvBloCSzGYmagaKx4ktaZ:f+c6m9YP0Aw5WCS6YzgUkq
Malware Config
Extracted
phorphiex
http://185.215.113.66/
0xCa90599132C4D88907Bd8E046540284aa468a035
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv
rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw
bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
2740827080.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" 2740827080.exe -
Processes:
2740827080.exesylsplvc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2740827080.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2740827080.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2740827080.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2740827080.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2740827080.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" 2740827080.exe -
Downloads MZ/PE file
-
Executes dropped EXE 8 IoCs
Processes:
B76.exe2740827080.exe1714631552.exe941323492.exe3160526188.exesylsplvc.exe104215876.exe11926235.exepid process 3036 B76.exe 2560 2740827080.exe 760 1714631552.exe 2652 941323492.exe 412 3160526188.exe 2148 sylsplvc.exe 1524 104215876.exe 548 11926235.exe -
Loads dropped DLL 11 IoCs
Processes:
2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exeB76.exe2740827080.exesylsplvc.exepid process 2500 2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe 3036 B76.exe 3036 B76.exe 2560 2740827080.exe 2560 2740827080.exe 2560 2740827080.exe 2560 2740827080.exe 2560 2740827080.exe 2148 sylsplvc.exe 2148 sylsplvc.exe 2148 sylsplvc.exe -
Processes:
2740827080.exesylsplvc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2740827080.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2740827080.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 2740827080.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2740827080.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2740827080.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2740827080.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" 2740827080.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sylsplvc.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
2740827080.exe3160526188.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\sysvpplvcr.exe" 2740827080.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sylsplvc.exe" 3160526188.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysvpplvcr.exe" 2740827080.exe -
Drops file in Windows directory 4 IoCs
Processes:
2740827080.exe3160526188.exedescription ioc process File created C:\Windows\sysvpplvcr.exe 2740827080.exe File opened for modification C:\Windows\sysvpplvcr.exe 2740827080.exe File created C:\Windows\sylsplvc.exe 3160526188.exe File opened for modification C:\Windows\sylsplvc.exe 3160526188.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
sylsplvc.exepid process 2148 sylsplvc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exepid process 2500 2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe 2500 2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe 2500 2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exeB76.exe2740827080.exe3160526188.exesylsplvc.exedescription pid process target process PID 2500 wrote to memory of 3036 2500 2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe B76.exe PID 2500 wrote to memory of 3036 2500 2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe B76.exe PID 2500 wrote to memory of 3036 2500 2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe B76.exe PID 2500 wrote to memory of 3036 2500 2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe B76.exe PID 3036 wrote to memory of 2560 3036 B76.exe 2740827080.exe PID 3036 wrote to memory of 2560 3036 B76.exe 2740827080.exe PID 3036 wrote to memory of 2560 3036 B76.exe 2740827080.exe PID 3036 wrote to memory of 2560 3036 B76.exe 2740827080.exe PID 2560 wrote to memory of 760 2560 2740827080.exe 1714631552.exe PID 2560 wrote to memory of 760 2560 2740827080.exe 1714631552.exe PID 2560 wrote to memory of 760 2560 2740827080.exe 1714631552.exe PID 2560 wrote to memory of 760 2560 2740827080.exe 1714631552.exe PID 2560 wrote to memory of 2652 2560 2740827080.exe 941323492.exe PID 2560 wrote to memory of 2652 2560 2740827080.exe 941323492.exe PID 2560 wrote to memory of 2652 2560 2740827080.exe 941323492.exe PID 2560 wrote to memory of 2652 2560 2740827080.exe 941323492.exe PID 2560 wrote to memory of 412 2560 2740827080.exe 3160526188.exe PID 2560 wrote to memory of 412 2560 2740827080.exe 3160526188.exe PID 2560 wrote to memory of 412 2560 2740827080.exe 3160526188.exe PID 2560 wrote to memory of 412 2560 2740827080.exe 3160526188.exe PID 412 wrote to memory of 2148 412 3160526188.exe sylsplvc.exe PID 412 wrote to memory of 2148 412 3160526188.exe sylsplvc.exe PID 412 wrote to memory of 2148 412 3160526188.exe sylsplvc.exe PID 412 wrote to memory of 2148 412 3160526188.exe sylsplvc.exe PID 2148 wrote to memory of 1524 2148 sylsplvc.exe 104215876.exe PID 2148 wrote to memory of 1524 2148 sylsplvc.exe 104215876.exe PID 2148 wrote to memory of 1524 2148 sylsplvc.exe 104215876.exe PID 2148 wrote to memory of 1524 2148 sylsplvc.exe 104215876.exe PID 2148 wrote to memory of 548 2148 sylsplvc.exe 11926235.exe PID 2148 wrote to memory of 548 2148 sylsplvc.exe 11926235.exe PID 2148 wrote to memory of 548 2148 sylsplvc.exe 11926235.exe PID 2148 wrote to memory of 548 2148 sylsplvc.exe 11926235.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\B76.exe"C:\Users\Admin\AppData\Local\Temp\B76.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2740827080.exeC:\Users\Admin\AppData\Local\Temp\2740827080.exe3⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1714631552.exeC:\Users\Admin\AppData\Local\Temp\1714631552.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\941323492.exeC:\Users\Admin\AppData\Local\Temp\941323492.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3160526188.exeC:\Users\Admin\AppData\Local\Temp\3160526188.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\sylsplvc.exeC:\Windows\sylsplvc.exe5⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: SetClipboardViewer
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\104215876.exeC:\Users\Admin\AppData\Local\Temp\104215876.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11926235.exeC:\Users\Admin\AppData\Local\Temp\11926235.exe6⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY2G78MW\1[1]Filesize
81KB
MD501e5faba64d8e9a9c187831fdc819f4c
SHA1350a1a2bf237e64f43716262f99c632f5e01ba62
SHA2567f4f76bd8fa91a71ce7999f9bbd0f7a63ca82d4e96b4d99cfad98edde1d85450
SHA512f4bc09ab9e4579b82707d6420e3b9df9ec4fd77e11ce5eb8304b45e3b5c9403c01de4e50f3c7f03f00f3ebc921646794638dccfded199bfe5f3fd727f3e57782
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY2G78MW\3[1]Filesize
86KB
MD5fe1e93f12cca3f7c0c897ef2084e1778
SHA1fb588491ddad8b24ea555a6a2727e76cec1fade3
SHA2562ebc4a92f4fdc27d4ab56e57058575a8b18adb076cbd30feea2ecdc8b7fcd41f
SHA51236e0524c465187ae9ad207c724aee45bcd61cfd3fa66a79f9434d24fcbadc0a743834d5e808e6041f3bd88e75deb5afd34193574f005ed97e4b17c6b0388cb93
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\2[1]Filesize
8KB
MD5145fc3dbf778aa2ba80af3d74eabfad6
SHA113dfeadb4b38c461f8b9d25853c0cae5d9a65f7c
SHA2565ab3bcaff0514c89388ea4958197ab0ff5bcc5999e1b95d830bc72da94bd4200
SHA5129bd7d50d489c4fc57ee1a0d3ad3cd2d29ca20f8ad1e46668a36d7ecced42db03a6980b039a2aeb7a1e1761aef89d994d73a497043ba744678290a8a9772a6306
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\4[1]Filesize
80KB
MD52ff2bb06682812eeb76628bfbe817fbb
SHA118e86614d0f4904e1fe97198ccda34b25aab7dae
SHA256985da56fb594bf65d8bb993e8e37cd6e78535da6c834945068040faf67e91e7d
SHA5125cd3b5a1e16202893b08c0ae70d3bcd9e7a49197ebf1ded08e01395202022b3b6c2d8837196ef0415fea6497d928b44e03544b934f8e062ddbb6c6f79fb6f440
-
\Users\Admin\AppData\Local\Temp\2740827080.exeFilesize
81KB
MD5f4713c8ac5fc1e4919156157e7bece19
SHA17bd9e35b1d1210183bbb4fe1995895cbc1692c62
SHA2562be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b
SHA512ecff8f3af212f444b5f44fd3bfd922556a49b9156fd7a20e13ebc60b4abe08b9d193a49556d4a8e776ef8083db77ab9667ec537dd44f863719e83cb3899cb46f
-
\Users\Admin\AppData\Local\Temp\3160526188.exeFilesize
79KB
MD51e8a2ed2e3f35620fb6b8c2a782a57f3
SHA1e924ce6d147ecc8b30b7c7cad02e5c9ae09a743a
SHA2563f16f4550826076b2c8cd7b392ee649aeb06740328658a2d30c3d2002c6b7879
SHA512ce4dc7fdd7f81a7a127d650f9175292b287b4803d815d74b64a4e5125cff66224d75e7ecade1d9c0e42f870bdb49a78e9613b1a49675ab5bc098611b99b49ade
-
\Users\Admin\AppData\Local\Temp\941323492.exeFilesize
8KB
MD5c34a248f132e739652407b0aa8c978cd
SHA1f7f05357fd6ab2d1a11e3427ee46626bb6ad94ee
SHA2564c9c53256ff65c9930c38b193537ad510930c25052231c7eef3715057b79e578
SHA512f7999e8b903fbc2e715d6d7e7bb0bc421cef79dbd61f6d94f18fa63c99a420d2a70d4b23fa0b8ec05d073c954aec718be588ada718bb0f5aacd618ad815f2703
-
\Users\Admin\AppData\Local\Temp\B76.exeFilesize
9KB
MD562b97cf4c0abafeda36e3fc101a5a022
SHA1328fae9acff3f17df6e9dc8d6ef1cec679d4eb2b
SHA256e172537adcee1fcdc8f16c23e43a5ac82c56a0347fa0197c08be979438a534ab
SHA51232bd7062aabd25205471cec8d292b820fc2fd2479da6fb723332887fc47036570bb2d25829acb7c883ccaaab272828c8effbc78f02a3deeabb47656f4b64eb24