Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 14:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe
Resource
win7-20240220-en
General
-
Target
2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe
-
Size
1.5MB
-
MD5
ba42ce69b31605095ac77ad2c7a0005f
-
SHA1
9f734fbbb72e2fccd7922a130d2a750813c7b0f3
-
SHA256
3de0d11224caea50c850cc01ac7b6c504c5497d36122280a957a825533b4985c
-
SHA512
2f62ef39c93687d139e2329d51b68072701ff306cfdccfe9d5f07177cafe3a23df0c6f89abc43d635c0f4141c34cb1ff70ec5292025f647f1635e1151361e2c3
-
SSDEEP
24576:YJrS+cYxf3X29pYfdD9QDC0YLwvBloCSzGYmagaKx4ktaZ:f+c6m9YP0Aw5WCS6YzgUkq
Malware Config
Extracted
phorphiex
http://185.215.113.66/
0xCa90599132C4D88907Bd8E046540284aa468a035
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv
rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw
bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
2571315296.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" 2571315296.exe -
Processes:
2571315296.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2571315296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2571315296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2571315296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2571315296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 2571315296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2571315296.exe -
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
3400.exe2571315296.exe3161620899.exe274113439.exepid process 4460 3400.exe 880 2571315296.exe 3520 3161620899.exe 3344 274113439.exe -
Processes:
2571315296.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2571315296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2571315296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 2571315296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2571315296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2571315296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 2571315296.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2571315296.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2571315296.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysvpplvcr.exe" 2571315296.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\sysvpplvcr.exe" 2571315296.exe -
Drops file in Windows directory 2 IoCs
Processes:
2571315296.exedescription ioc process File created C:\Windows\sysvpplvcr.exe 2571315296.exe File opened for modification C:\Windows\sysvpplvcr.exe 2571315296.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exepid process 4704 2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe 4704 2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe 4704 2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe3400.exe2571315296.exedescription pid process target process PID 4704 wrote to memory of 4460 4704 2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe 3400.exe PID 4704 wrote to memory of 4460 4704 2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe 3400.exe PID 4704 wrote to memory of 4460 4704 2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe 3400.exe PID 4460 wrote to memory of 880 4460 3400.exe 2571315296.exe PID 4460 wrote to memory of 880 4460 3400.exe 2571315296.exe PID 4460 wrote to memory of 880 4460 3400.exe 2571315296.exe PID 880 wrote to memory of 3520 880 2571315296.exe 3161620899.exe PID 880 wrote to memory of 3520 880 2571315296.exe 3161620899.exe PID 880 wrote to memory of 3520 880 2571315296.exe 3161620899.exe PID 880 wrote to memory of 3344 880 2571315296.exe 274113439.exe PID 880 wrote to memory of 3344 880 2571315296.exe 274113439.exe PID 880 wrote to memory of 3344 880 2571315296.exe 274113439.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_ba42ce69b31605095ac77ad2c7a0005f_icedid.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3400.exe"C:\Users\Admin\AppData\Local\Temp\3400.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2571315296.exeC:\Users\Admin\AppData\Local\Temp\2571315296.exe3⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3161620899.exeC:\Users\Admin\AppData\Local\Temp\3161620899.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\274113439.exeC:\Users\Admin\AppData\Local\Temp\274113439.exe4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SFG3KXO7\3[1]Filesize
86KB
MD5fe1e93f12cca3f7c0c897ef2084e1778
SHA1fb588491ddad8b24ea555a6a2727e76cec1fade3
SHA2562ebc4a92f4fdc27d4ab56e57058575a8b18adb076cbd30feea2ecdc8b7fcd41f
SHA51236e0524c465187ae9ad207c724aee45bcd61cfd3fa66a79f9434d24fcbadc0a743834d5e808e6041f3bd88e75deb5afd34193574f005ed97e4b17c6b0388cb93
-
C:\Users\Admin\AppData\Local\Temp\2571315296.exeFilesize
81KB
MD5f4713c8ac5fc1e4919156157e7bece19
SHA17bd9e35b1d1210183bbb4fe1995895cbc1692c62
SHA2562be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b
SHA512ecff8f3af212f444b5f44fd3bfd922556a49b9156fd7a20e13ebc60b4abe08b9d193a49556d4a8e776ef8083db77ab9667ec537dd44f863719e83cb3899cb46f
-
C:\Users\Admin\AppData\Local\Temp\274113439.exeFilesize
8KB
MD5c34a248f132e739652407b0aa8c978cd
SHA1f7f05357fd6ab2d1a11e3427ee46626bb6ad94ee
SHA2564c9c53256ff65c9930c38b193537ad510930c25052231c7eef3715057b79e578
SHA512f7999e8b903fbc2e715d6d7e7bb0bc421cef79dbd61f6d94f18fa63c99a420d2a70d4b23fa0b8ec05d073c954aec718be588ada718bb0f5aacd618ad815f2703
-
C:\Users\Admin\AppData\Local\Temp\3400.exeFilesize
9KB
MD562b97cf4c0abafeda36e3fc101a5a022
SHA1328fae9acff3f17df6e9dc8d6ef1cec679d4eb2b
SHA256e172537adcee1fcdc8f16c23e43a5ac82c56a0347fa0197c08be979438a534ab
SHA51232bd7062aabd25205471cec8d292b820fc2fd2479da6fb723332887fc47036570bb2d25829acb7c883ccaaab272828c8effbc78f02a3deeabb47656f4b64eb24