Static task
static1
Behavioral task
behavioral1
Sample
2024-04-21_edd1c9520ec223ac661e641925fc7e89_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-21_edd1c9520ec223ac661e641925fc7e89_icedid.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-21_edd1c9520ec223ac661e641925fc7e89_icedid
-
Size
9.8MB
-
MD5
edd1c9520ec223ac661e641925fc7e89
-
SHA1
23d082d1779456db0a8b51ed2d10d790045c4271
-
SHA256
82c47ae7af013a249d1a4dfddecc8e7927f0f19917be510e5f14183921c1f16b
-
SHA512
ff83785b4abc122f54ab06c85288bd601dadd7c4b2a0ae92a31fa3e724e6b9aaf6b4183ab365b154267039eba814d24291451f2364d1cfdaae475068b1450f1a
-
SSDEEP
196608:2orEe3Mwh8stdSfP9FRu/sVklYvUVBITMidrV6JsSptJgGKTiJWojDIg9Cbk/V89:2oIe3M8d8PCYkGvUVBITMidJadKeJtDa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-21_edd1c9520ec223ac661e641925fc7e89_icedid
Files
-
2024-04-21_edd1c9520ec223ac661e641925fc7e89_icedid.exe windows:5 windows x86 arch:x86
76eb288f8ace3afad43d59c75821a575
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeEnvironmentStringsW
GetEnvironmentStringsW
CompareStringW
GetDriveTypeW
WriteConsoleW
GetCurrentDirectoryW
CreateFileW
SetEnvironmentVariableA
LeaveCriticalSection
EnterCriticalSection
Sleep
GetTickCount
IsValidLocale
DeleteCriticalSection
_lclose
GlobalFree
GlobalUnlock
FindClose
FindNextFileA
FindFirstFileA
LCMapStringA
InterlockedCompareExchange
Beep
SetProcessWorkingSetSize
OpenFile
EnumSystemLocalesA
GetConsoleMode
GetConsoleCP
SetHandleCount
GetStringTypeW
GetLocaleInfoW
TerminateProcess
IsDebuggerPresent
InitializeCriticalSection
SetUnhandledExceptionFilter
GetComputerNameA
GlobalLock
GlobalAlloc
CreateProcessA
SizeofResource
LockResource
LoadResource
FindResourceW
WideCharToMultiByte
GetLastError
GetExitCodeThread
CloseHandle
CreateEventA
ResumeThread
SetThreadPriority
ResetEvent
WaitForMultipleObjects
SetEvent
LocalFree
FormatMessageA
HeapFree
HeapAlloc
GetProcessHeap
WaitForSingleObject
GetVersion
WaitCommEvent
SetCommMask
ReadFile
WriteFile
GetOverlappedResult
TerminateThread
SetCommTimeouts
SetCommState
ClearCommError
EscapeCommFunction
PurgeComm
GetCommModemStatus
SetCommBreak
ClearCommBreak
lstrcpyA
lstrcmpA
GetCommState
lstrlenA
ExitThread
SetupComm
GetCommTimeouts
CreateFileA
CreateThread
LoadLibraryA
GetModuleHandleA
GetProcAddress
SetLastError
DeactivateActCtx
ActivateActCtx
MulDiv
GetLocaleInfoA
InterlockedIncrement
InterlockedDecrement
GetFileAttributesA
lstrcatA
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemTime
GetLocalTime
GetDateFormatA
GetTimeFormatA
SystemTimeToTzSpecificLocalTime
LocalFileTimeToFileTime
CreateDirectoryA
FreeLibrary
LoadLibraryExA
GetModuleFileNameA
SetCurrentDirectoryA
CopyFileA
RemoveDirectoryA
DeleteFileA
MoveFileA
GlobalReAlloc
MultiByteToWideChar
GetCurrentThreadId
GetPrivateProfileStringA
FreeResource
FindResourceA
FileTimeToLocalFileTime
GetLogicalDriveStringsA
GetCurrentDirectoryA
GetFileAttributesExA
CompareFileTime
WriteProfileStringW
GetDriveTypeA
GetWindowsDirectoryA
GetShortPathNameA
GetSystemDirectoryA
MoveFileExA
GetExitCodeProcess
QueryPerformanceFrequency
QueryPerformanceCounter
SuspendThread
GlobalSize
GetCPInfo
IsValidCodePage
LCMapStringW
GetACP
IsDBCSLeadByteEx
GetVersionExA
ExpandEnvironmentStringsA
lstrlenW
CreateMutexA
ReleaseMutex
CreateActCtxW
ReleaseActCtx
GetModuleFileNameW
lstrcmpW
LoadLibraryW
InitializeCriticalSectionAndSpinCount
CompareStringA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetCurrentProcessId
GetStringTypeExA
GetThreadLocale
lstrcmpiA
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetCurrentProcess
GetVolumeInformationA
GetFullPathNameA
GetUserDefaultLCID
ReplaceFileA
SetFileTime
GetFileTime
GetTempFileNameA
GetDiskFreeSpaceA
VirtualProtect
InterlockedExchange
GetSystemDirectoryW
LocalAlloc
GetFileSizeEx
TlsGetValue
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GetModuleHandleW
GetSystemDefaultUILanguage
ConvertDefaultLocale
GetUserDefaultUILanguage
GetCurrentThread
GetPrivateProfileIntA
WritePrivateProfileStringA
GlobalFlags
GetOEMCP
GetProfileIntA
SetErrorMode
FindResourceExW
SearchPathA
GetTempPathA
GetNumberFormatA
DecodePointer
EncodePointer
RtlUnwind
RaiseException
ExitProcess
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
SetStdHandle
GetFileType
HeapSize
HeapQueryInformation
IsProcessorFeaturePresent
GetStdHandle
HeapCreate
UnhandledExceptionFilter
_lwrite
user32
GetMenuCheckMarkDimensions
CheckMenuItem
LoadIconA
SendDlgItemMessageA
WinHelpA
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetWindowTextLengthA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessagePos
MonitorFromWindow
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ValidateRect
GetClassInfoExA
GetClassInfoA
RegisterClassA
EqualRect
DeferWindowPos
SetWindowPlacement
GetWindowPlacement
GetMenu
GetWindowDC
GrayStringA
DrawTextExA
GetMenuState
GetMenuStringA
RemoveMenu
DestroyWindow
DrawTextW
DrawTextA
GetDoubleClickTime
ShowWindow
CreatePopupMenu
AdjustWindowRectEx
MapWindowPoints
DestroyMenu
MonitorFromRect
EndPaint
GetUpdateRgn
HideCaret
RegisterClassExA
IsChild
SetFocus
ShowCaret
BeginPaint
RegisterClassExW
GetKeyboardLayout
RegisterClipboardFormatA
GetScrollInfo
CreateWindowExA
IsWindowUnicode
ScrollWindow
DefWindowProcA
DestroyCaret
AppendMenuA
CreateCaret
SetCaretPos
SetClipboardData
SetScrollInfo
GetMessageTime
SetMenuItemBitmaps
GetIconInfo
DrawEdge
DrawStateA
GetSystemMenu
EnableMenuItem
TranslateAcceleratorA
MsgWaitForMultipleObjects
CallWindowProcA
SetWindowLongA
GetTabbedTextExtentA
TabbedTextOutA
PeekMessageA
WaitForInputIdle
MonitorFromPoint
GetMonitorInfoA
LoadCursorFromFileA
GetCursor
GetWindowLongA
SetWindowPos
RedrawWindow
BringWindowToTop
IsZoomed
DestroyCursor
IntersectRect
GetForegroundWindow
GetAsyncKeyState
LoadIconW
SetForegroundWindow
GetLastActivePopup
FindWindowA
IsIconic
CopyIcon
SetParent
SetCursorPos
LoadMenuA
GetDlgCtrlID
CharUpperA
InsertMenuItemA
LoadAcceleratorsA
MessageBoxA
wsprintfA
LoadImageA
OemToCharBuffA
GetClipboardData
SetWindowsHookExA
LoadBitmapA
CallNextHookEx
UnhookWindowsHookEx
GetWindowTextA
SetWindowTextA
GetWindow
SystemParametersInfoA
InflateRect
GetDlgItem
ReleaseCapture
LoadCursorA
SetCursor
GetCursorPos
CheckDlgButton
CheckRadioButton
SetDlgItemTextA
IsDialogMessageA
MoveWindow
IsWindowEnabled
ScrollWindowEx
GetWindowThreadProcessId
DrawIcon
SetWindowRgn
LoadCursorW
EndDialog
CreateDialogIndirectParamA
WindowFromPoint
TranslateMessage
DispatchMessageA
DrawIconEx
DrawFocusRect
FillRect
GetDialogBaseUnits
EnumClipboardFormats
GetCaretPos
LockWindowUpdate
ScreenToClient
GetMenuItemID
GetActiveWindow
GetMessageA
GetMenuItemInfoA
GetKeyNameTextA
MapVirtualKeyA
UnionRect
GetNextDlgGroupItem
EnableScrollBar
PostMessageA
IsWindow
LoadBitmapW
GetClientRect
GetDC
ReleaseDC
SetTimer
KillTimer
EnableWindow
GetSysColorBrush
GetNextDlgTabItem
LoadStringA
ClipCursor
CharLowerA
IsCharAlphaA
GetOpenClipboardWindow
ChildWindowFromPoint
GetParent
SendMessageA
GetFocus
GetClassNameA
IsClipboardFormatAvailable
CopyRect
OffsetRect
TranslateMDISysAccel
DeleteMenu
GetMenuItemCount
GetSubMenu
InsertMenuA
ModifyMenuA
LoadMenuW
GetWindowRect
ReuseDDElParam
UnpackDDElParam
MapDialogRect
ClientToScreen
UpdateWindow
InvalidateRect
TrackPopupMenu
PtInRect
SetRectEmpty
FrameRect
IsWindowVisible
GetCapture
SetCapture
ShowScrollBar
OpenClipboard
GetKeyState
CloseClipboard
EmptyClipboard
GetDesktopWindow
GetSysColor
DestroyIcon
MessageBeep
SetRect
SetActiveWindow
GetSystemMetrics
RegisterWindowMessageA
IsRectEmpty
NotifyWinEvent
CopyImage
LoadImageW
SetClassLongA
DrawFrameControl
EnumDisplayMonitors
SetLayeredWindowAttributes
GetUpdateRect
CountClipboardFormats
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
GetWindowRgn
GetDCEx
MapVirtualKeyExA
IsCharLowerA
InvertRect
SendNotifyMessageA
SubtractRect
CharUpperBuffA
GetTabbedTextExtentW
CreateMenu
EnumChildWindows
CreateAcceleratorTableA
GetKeyboardState
ToAsciiEx
CopyAcceleratorTableA
PostThreadMessageA
GetMenuDefaultItem
SetMenuDefaultItem
RealChildWindowFromPoint
WaitMessage
IsMenu
UpdateLayeredWindow
DestroyAcceleratorTable
LoadAcceleratorsW
ShowOwnedPopups
PostQuitMessage
UnregisterClassA
gdi32
CreatePenIndirect
CreateBrushIndirect
SetBrushOrgEx
CreateHalftonePalette
CreateEllipticRgnIndirect
BeginPath
CloseFigure
EndPath
InvertRgn
UnrealizeObject
CreateICA
SetPixelV
GetBoundsRect
PtInRegion
SetPaletteEntries
ExtFloodFill
EnumFontFamiliesExA
GetWindowOrgEx
GetTextExtentPointA
GetTextFaceA
GetTextAlign
GetStretchBltMode
GetROP2
GetPolyFillMode
GetBkMode
GetRgnBox
OffsetRgn
GetCharWidthA
GetMapMode
SetRectRgn
GetTextCharsetInfo
EnumFontFamiliesA
CreateDIBitmap
GetTextColor
SetDIBColorTable
CreateRoundRectRgn
SetPixel
CreateRectRgnIndirect
GetNearestPaletteIndex
GetPaletteEntries
LPtoDP
CreateEllipticRgn
CreateHatchBrush
ExtCreatePen
GetObjectType
ExtSelectClipRgn
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
Escape
TextOutA
RectVisible
PtVisible
GetPixel
GetWindowExtEx
GetViewportExtEx
SelectClipPath
GetClipRgn
SelectClipRgn
SetLayout
GetLayout
ExcludeClipRect
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
RestoreDC
SaveDC
CreateDCA
CopyMetaFileA
MoveToEx
GetTextExtentPoint32W
LineTo
SetTextColor
DeleteDC
CreateDIBSection
SetBkColor
SetBkMode
Rectangle
ExtTextOutW
Ellipse
GetTextExtentExPointW
GetTextExtentExPointA
GetNearestColor
CreatePatternBrush
CreatePen
RoundRect
SetTextAlign
IntersectClipRect
TranslateCharsetInfo
CombineRgn
CreateRectRgn
SetStretchBltMode
SetDIBitsToDevice
PatBlt
FrameRgn
FillRgn
CreatePolygonRgn
EndDoc
AbortDoc
SetAbortProc
EndPage
StartPage
StartDocA
DPtoLP
GetViewportOrgEx
SetViewportOrgEx
UpdateColors
Polygon
Polyline
GetSystemPaletteEntries
GetStockObject
SelectPalette
RealizePalette
GetDIBits
StretchBlt
CreatePalette
CreateBitmap
StretchDIBits
SelectObject
GetCurrentObject
CreateFontIndirectA
GetBkColor
CreateSolidBrush
GetTextMetricsA
GetTextExtentPoint32A
ExtTextOutA
GetDeviceCaps
DeleteObject
BitBlt
CreateCompatibleDC
GetObjectA
CreateCompatibleBitmap
msimg32
TransparentBlt
AlphaBlend
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
ClosePrinter
OpenPrinterA
GetJobA
advapi32
RegDeleteValueA
RegEnumValueA
RegEnumKeyExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
GetUserNameA
RegSetValueA
RegOpenKeyExW
SetFileSecurityA
GetFileSecurityA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
shell32
SHGetDesktopFolder
SHGetPathFromIDListA
SHGetSpecialFolderLocation
DragAcceptFiles
SHCreateDirectoryExA
SHGetFileInfoA
DragQueryFileA
SHAddToRecentDocs
ExtractIconA
ShellExecuteA
SHAppBarMessage
DragFinish
SHGetMalloc
SHBrowseForFolderA
comctl32
ord17
ImageList_GetIconSize
ImageList_DrawEx
InitCommonControlsEx
_TrackMouseEvent
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_Create
ImageList_GetImageCount
ImageList_Destroy
shlwapi
PathIsUNCA
UrlUnescapeA
PathRemoveFileSpecW
PathFindExtensionA
PathRemoveExtensionA
PathStripToRootA
PathFindFileNameA
ole32
OleFlushClipboard
StgCreateDocfile
StgOpenStorageOnILockBytes
OleIsCurrentClipboard
OleSetClipboard
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateILockBytesOnHGlobal
CreateFileMoniker
StgOpenStorage
StgIsStorageFile
StgCreateDocfileOnILockBytes
OleSave
WriteClassStm
OleSaveToStream
OleLockRunning
OleCreateFromData
OleCreateLinkFromData
OleCreateStaticFromData
OleCreate
OleLoad
GetHGlobalFromILockBytes
OleInitialize
RevokeDragDrop
CoInitialize
CoCreateInstance
CoUninitialize
OleSetContainedObject
OleCreateFromFile
OleCreateLinkToFile
OleGetIconOfClass
CreateGenericComposite
OleSetMenuDescriptor
CoRevokeClassObject
CoRegisterMessageFilter
CreateDataAdviseHolder
CLSIDFromProgID
IsAccelerator
OleTranslateAccelerator
OleGetClipboard
CoLockObjectExternal
CLSIDFromString
CreateItemMoniker
CoFreeUnusedLibraries
CoCreateGuid
CoInitializeEx
CreateStreamOnHGlobal
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
RegisterDragDrop
DoDragDrop
OleUninitialize
CoDisconnectObject
oleaut32
SysStringLen
SysAllocString
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
VarBstrFromDate
SysFreeString
VariantTimeToSystemTime
VarDateFromStr
SystemTimeToVariantTime
VarUdateFromDate
VarR8FromStr
oledlg
ord8
ord4
ord3
ord11
gdiplus
GdipDrawImageRectI
GdipDrawImageI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdiplusShutdown
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusStartup
GdipGetImageGraphicsContext
wsock32
ntohl
WSAGetLastError
gethostbyname
WSAIsBlocking
__WSAFDIsSet
select
inet_ntoa
send
WSAStartup
WSACleanup
socket
closesocket
setsockopt
connect
htonl
htons
recv
getsockname
bind
recvfrom
sendto
ftd2xx
ord19
ord51
ord58
ord54
ord49
ord56
ord2
ord16
ord6
ord17
ord3
ord4
ord21
ord77
ord61
ord27
ord20
ord57
iphlpapi
GetAdaptersInfo
oleacc
AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject
wininet
FtpCommandA
FtpOpenFileA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
FtpGetCurrentDirectoryA
FtpRemoveDirectoryA
FtpCreateDirectoryA
FtpRenameFileA
FtpDeleteFileA
InternetQueryDataAvailable
InternetSetOptionExA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetOpenA
InternetConnectA
FtpFindFirstFileA
InternetFindNextFileA
InternetSetStatusCallback
InternetCloseHandle
InternetGetLastResponseInfoA
FtpSetCurrentDirectoryA
imm32
ImmReleaseContext
ImmGetOpenStatus
ImmNotifyIME
ImmSetCompositionFontA
ImmGetContext
ImmGetCompositionStringW
ImmSetCompositionWindow
winmm
PlaySoundA
Sections
.text Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 131KB - Virtual size: 6.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ